portal-coinspot[.]com

This domain, portal-coinspot.com, operates as a credential theft platform specifically targeting cryptocurrency exchange users. Analysis of the site's content and infrastructure reveals it impersonates CoinSpot, a legitimate Australian cryptocurrency exchange, to harvest login credentials and two-factor authentication codes. The fraudulent verification page, titled 'Please verify,' mimics CoinSpot's authentication flow, increasing the likelihood of successful account compromise for victims who enter sensitive information. Technical indicators confirm the malicious nature of this domain. The site is flagged by 6 out of 95 security vendors on VirusTotal, with detection signatures identifying credential phishing patterns. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 11, 2026, the domain appears on one security blocklist and resolves to IP address 172.67.168.35. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, common among phishing sites to obscure origin servers and evade detection. The creation date discrepancy (2026) suggests domain registration timestamp manipulation to bypass age-based reputation checks. Users who visited portal-coinspot.com should immediately revoke any entered credentials and enable additional authentication factors on their legitimate CoinSpot accounts. Monitor connected wallets and exchange accounts for unauthorized transactions, as compromised credentials may lead to cryptocurrency theft. Report the incident to the legitimate exchange's security team and consider submitting suspicious URLs to threat intelligence platforms. Network administrators should block the domain and associated IP address (172.67.168.35) at perimeter security controls to prevent access from corporate networks.