portaltobitcoin[.]run

Analysis of portaltobitcoin.run shows it was deliberately registered to impersonate the Bitcoin brand in a crypto‑scam campaign. The domain was configured with Cloudflare DNS (carter.ns.cloudflare.com, izabella.ns.cloudflare.com) and resolved to the Cloudflare IP address 188.114.96.3, located in the United States under ASN 13335. No TLS certificate was present, and an HTTP request returned the generic page title "Just a moment...", indicating that a challenge page was served before any content could be examined. Registration details list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar, a provider commonly used for rapid bulk registrations.

The site was flagged by PhishDestroy and appears on one external security blocklist, confirming that threat‑intelligence sources have identified it as malicious. VirusTotal scans show three of ninety‑five security vendors flagged the domain, providing independent corroboration of its malicious nature. The threat type is recorded as brand impersonation with an elevated risk rating, and the scam type is identified as a crypto scam targeting Bitcoin users.

Current status is offline, suggesting the domain has been taken down or the hosting was terminated, but the underlying infrastructure (Cloudflare front‑end and DNS configuration) remains observable and could be reused if the operator re‑registers a similar domain. Defenders should continue to block the domain at network perimeter and DNS layers, incorporate the domain hash into threat‑intel feeds, and monitor the associated IP range (188.114.96.0/24) for any re‑appearance of malicious activity. Additionally, organizations should educate users about unsolicited requests referencing Bitcoin and advise scrutiny of any site that redirects to a "Just a moment..." page without proper TLS, as these indicators were present in this case.