portal-ether[.]xyz

Analysis of portal-ether.xyz confirms its classification as an active crypto scam domain, operational since March 22, 2026. The domain currently resolves to 188.114.96.3, a Cloudflare-hosted IP located in Canada, and is protected by Cloudflare infrastructure, including HTTP/3 support and nameservers anuj.ns.cloudflare.com and dora.ns.cloudflare.com. The site's SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. The domain is flagged by three security blocklists and has been explicitly blocked by at least three security providers, including MetaMask, indicating its targeting of cryptocurrency users. A VirusTotal scan reports detection by 4 of 94 security vendors, though this should be interpreted as a partial indicator rather than definitive proof of malicious activity. The domain's Gridinsoft trust score of 0/100 further supports its high-risk classification. Current HTTP status returns a 403 Forbidden error, while the page title displays a 504 Gateway Time-out message. This suggests the site may be experiencing temporary technical issues or has been partially taken down, though the domain remains registered and active. No specific phishing kit or brand impersonation has been confirmed in available data, but the scam type is explicitly categorized as a crypto scam. Defenders should treat portal-ether.xyz as a confirmed malicious domain. Recommended actions include blocking the domain and its resolved IP at the network level, monitoring for related subdomains or newly registered lookalike domains, and alerting users to potential crypto-related scams associated with this infrastructure. Given its continued activity despite blocklist inclusion, this domain may resurface with updated content or infrastructure.