princexchangeverify[.]com

The domain princexchangeverify.com has been identified as a credential-phishing portal specifically designed to impersonate a cryptocurrency verification service. Analysis of the page title, "Prinxchange Verify – Virtual SMS Verification," indicates an attempt to deceive users into submitting sensitive account credentials under the guise of a legitimate verification process. The domain is currently offline, though prior activity suggests it was actively targeting users seeking SMS-based authentication for crypto transactions. Infrastructure analysis reveals the domain was registered through NAMECHEAP INC on March 22, 2026, an unusually future-dated creation that may indicate evasion tactics or data entry error. It resolves to the IP address 157.90.178.254 and has been flagged by 4 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and employs SSL encryption via a certificate issued by Sectigo Limited. Detected technologies include PHP, LiteSpeed web server, Alpine.js, and HTTP/3, suggesting a modern but deceptive web infrastructure designed to mimic legitimate platforms. Current status indicates the domain has been taken offline, though residual risk remains due to its recent registration and prior phishing activity. Organizations and individuals are advised to block the domain and associated IP address (157.90.178.254) at the network level. Users who may have interacted with the site should immediately revoke any submitted credentials, enable multi-factor authentication on all financial and crypto-related accounts, and monitor for unauthorized transactions. Security teams should review logs for connections to the IP and domain, as well as any related SSL certificates, to identify potential compromise.