portal[.]itonexus[.]com

Analysis indicates that portal.itonexus.com is an active phishing domain targeting users under the guise of 'Technology Success,' as evidenced by its page title. The domain was registered on February 21, 2026, through HOSTINGER operations, UAB, and currently resolves to the IP address 104.18.32.163, hosted on Cloudflare's infrastructure (AS13335). Nameservers ns1.dns-parking.com and ns2.dns-parking.com are associated with the domain, a configuration often observed in low-cost or disposable hosting setups favored by threat actors. The domain is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a trust score of 0/100, reinforcing its classification as high-risk. Technical indicators further support its malicious nature. The domain employs a Google Trust Services SSL certificate (WE1), which, while providing encryption, does not validate legitimacy. Detected technologies include Node.js, Express, Pendo, HSTS, and Cloudflare, suggesting a structured phishing framework designed to evade basic detection mechanisms. As of July 12, 2026, the domain remains active, returning an HTTP 200 status, and has been flagged by 2 of 95 security vendors in scans. The exact nature of the phishing campaign—whether it targets credentials, financial data, or other sensitive information—remains unconfirmed due to the absence of detailed page analysis. However, the combination of a benign-sounding page title ('Technology Success'), Cloudflare hosting, and a low-reputation registration pattern aligns with known phishing tactics. Defenders are advised to block the domain at the network level, monitor for related infrastructure, and alert users to avoid interaction. Further investigation into the domain's content and associated campaigns is recommended to determine the full scope of the threat.