portal-yield[.]xyz

PhishDestroy identifies portal-yield.xyz as an active cryptocurrency wallet credential theft scam posing as a financial yield portal. The domain leverages impersonation tactics targeting users seeking investment opportunities, with infrastructure designed to harvest private keys, seed phrases, or API access tokens from wallets connected to decentralized finance (DeFi) platforms. No known drainer kit signatures were detected in this sample, suggesting the threat actors may employ custom or obfuscated JavaScript payloads executed via cloned interface overlays. The campaign’s objective is clear: to exfiltrate wallet credentials to facilitate immediate fund abstraction or long-term account takeover in high-value DeFi ecosystems.

This domain was flagged with a VirusTotal detection score of 0/95 as of investigation start date using seed a2538f, indicating zero antivirus coverage despite active malicious hosting. It resolves to IPv4 address 104.21.82.50 and was registered through Dynadot LLC on March 17, 2026. Google Safe Browsing (GSB) currently lists this domain as under_investigation with no active block status. Third-party threat intelligence platforms have not yet flagged this domain in common blocklists, increasing exposure risk to users reliant on real-time domain reputation services. The combination of recent registration, low detection coverage, and lack of GSB blocking creates a high-risk window for propagation through unsuspecting users.

The scam remains active with domain infrastructure operational and SSL certificate issued by Let’s Encrypt, providing a false sense of legitimacy via HTTPS. Immediate response actions include coordinated takedown requests to the hosting provider (Cloudflare for 104.21.82.50), domain registrar (Dynadot LLC), and SSL issuer to revoke certificate and suspend hosting. Users should block portal-yield.xyz at DNS and browser levels, and report the domain through official channels (e.g., Google Safe Browsing Report Page). Remaining risk is elevated due to low detection coverage and lack of widespread blocking. Users interacting with any financial portal must verify domain authenticity via official project websites, use hardware wallets for transactions, and avoid entering wallet credentials on web interfaces not explicitly trusted.