claim-theportal[.]com

Analysis of claim-theportal.com, created on September 16, 2025 and currently taken offline, shows a brand‑impersonation infrastructure targeting Discord users with a crypto‑drain scheme. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv6 address 2606:4700:3030::6815:3001, an address belonging to AS13335 Cloudflare, Inc. in the United States. Nameserver delegation points to camilo.ns.cloudflare.com and virginia.ns.cloudflare.com, confirming Cloudflare as the hosting provider. No SSL certificate is presented, indicating the site was served over plain HTTP when active.

The page title observed during the brief live period was "Portals | Play, Collect & Create!", which bears no obvious relation to the Discord brand and suggests a generic landing page was used to attract victims. Gridinsoft assigned a trust score of 0 out of 100, effectively flagging the domain as fully malicious. Detection platforms have recorded limited but notable activity: two of ninety‑five VirusTotal scanners flagged the domain, and it appears on two external blocklists. Both PhishDestroy and ScamSniffer have already blocked the host, reinforcing the consensus that the site is malicious.

While the exact phishing kit, payload, or lure details have not been disclosed, the combination of brand impersonation, a crypto‑focused scam label, and the low trust score implies a credential‑harvesting or crypto‑wallet compromise workflow. Defenders should immediately add claim-theportal.com to DNS blocklists, enforce HTTPS‑only policies to prevent fallback to unsecured connections, and monitor traffic to the associated Cloudflare IPv6 address for any residual activity. Continuous observation of new registrations using the same registrar or similar naming patterns is advised, as the threat actor may reuse the infrastructure for future campaigns.