portalveicular-rs[.]shop

This domain, portalveicular-rs.shop, is currently classified as a high‑risk generic phishing site. The registration record shows it was created on 5 May 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain remains active as of 12 July 2026 and returns an HTTP 403 status code, indicating that the web server is deliberately refusing standard requests. Infrastructure analysis reveals that portalveicular-rs.shop is hosted behind Cloudflare, using the nameservers addyson.ns.cloudflare.com and karl.ns.cloudflare.com. The service supports HTTP/3 and presents a Let’s Encrypt certificate (issuer identifier E8). DNS resolution points to IP 188.114.96.3, which is allocated to Cloudflare, Inc. in Canada. Threat intelligence sources corroborate the malicious classification. VirusTotal scans have flagged the domain in 15 of 95 security engines. AlienVault OTX lists the domain in a single pulse, and PhishDestroy already blocks it. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external blocklist, confirming its reputation as an active phishing vector. Defenders should immediately add portalveicular-rs.shop to outbound and inbound deny lists across firewalls, proxy appliances, and DNS filtering solutions. Continuous monitoring of DNS queries for the associated Cloudflare IP range is recommended to detect any pivoting attempts. Where possible, sinkholing the domain or redirecting traffic to a safe landing page can reduce user exposure while investigative teams gather additional artifacts.