powergrp[.]net

This domain, powergrp.net, operates as a credential harvesting site specifically targeting users of a major cryptocurrency exchange platform. Analysis indicates the site replicates the legitimate exchange's interface, including identical page titles and visual branding, to deceive victims into submitting login credentials, two-factor authentication codes, and recovery phrases. The infrastructure is designed to mimic secure connections, utilizing a Let's Encrypt SSL certificate to create a false sense of legitimacy while capturing sensitive account information for unauthorized access or fund theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 07, 2026, through DNC Holdings, Inc., and resolves to the IP address 192.185.113.151, hosted on AS31898 within the United States. Security vendors have flagged the domain in 13 out of 95 detection engines on VirusTotal, while three independent security blocklists—including specialized cryptocurrency threat feeds—have listed the site as malicious. The domain's rapid inclusion in these blocklists suggests active monitoring and prompt classification by the security community. Users who accessed powergrp.net should immediately revoke any active sessions on the legitimate platform and rotate all credentials associated with their account. It is critical to enable additional authentication mechanisms, such as hardware-based security keys, if supported. Monitoring for unauthorized transactions or account modifications is strongly advised, and any suspicious activity should be reported to the platform's official security team. Given the domain's current offline status, affected users should remain vigilant for follow-up phishing attempts via email or other communication channels, as attackers may attempt to re-engage compromised accounts.