portalpeaqpool[.]xyz

PhishDestroy identifies portalpeaqpool.xyz as an active crypto drainer phishing domain posing as a legitimate service. This domain mimics the Peaq ecosystem to deceive users into connecting wallets and approving malicious transactions. Attackers leverage a just-in-time domain registration window—created October 08, 2025—to exploit user trust and bypass traditional defenses. This domain was flagged by 6 of 95 VirusTotal security vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and already appears on three major blocklists including Polkot, Codeesura, and Enkrypt. It resolves to IP 188.114.96.3 and uses a Google Trust Services SSL certificate to appear legitimate. The combination of freshly registered domains, low detection rates at inception, and rapid flagging by enterprise security platforms indicates a sophisticated and opportunistic campaign likely targeting cryptocurrency users across multiple regions. If you or your organization accessed portalpeaqpool.xyz, disconnect any connected wallets immediately—especially those holding assets on networks like Peaq, Ethereum, or Polkadot. Revoke any unauthorized token approvals via tools such as Etherscan or Revoke.cash. Run a full antivirus scan and audit browser extensions for suspicious activities. Report the domain to your security team or via threat intelligence platforms like Abuse.ch or URLVoid. Proactively warn employees and users about the risks of new crypto-related domains, and consider enforcing DNS filtering rules to block known malicious IPs like 188.114.96.3 across your network.