pionex-portal[.]com

This domain, pionex-portal.com, is confirmed as a cryptocurrency credential theft operation targeting users of a legitimate crypto exchange platform. Analysis indicates the site is designed to harvest login credentials, API keys, and two-factor authentication codes through a spoofed interface, enabling unauthorized access to victim accounts. No direct evidence of a crypto drainer kit was observed, but the credential theft mechanism poses immediate risk of asset compromise through subsequent unauthorized transactions. Infrastructure analysis reveals the following technical indicators: the domain was registered on January 05, 2026, through NiceNIC International Group Co., Limited, an entity frequently associated with high-risk registrations. It resolves to the loopback IP address 127.0.0.1, suggesting recent takedown or evasion tactics. The domain is flagged by 6 out of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate is issued by PhishDestroy, a known issuer for phishing infrastructure. Google Safe Browsing status is not explicitly listed, but the domain's offline status indicates probable prior detection. The domain has been taken offline, likely following detection and enforcement actions. While no longer active, the infrastructure remains a residual risk due to potential re-deployment under a new domain or IP. Users who interacted with the site are advised to immediately revoke any exposed credentials, rotate API keys, and enable multi-factor authentication on all cryptocurrency accounts. Organizations should monitor for related domains registered through the same registrar and certificate authority, as these may indicate follow-up campaigns.