portentscan.xyz
Appeared in the .xyz zone on Friday, September 25, 2026; by the end of that day the census found active website about crypto web3. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page is a self-branded token-risk scanner (PORTENT, with OMEN and SIBYL) whose only forms are GET-to-self fields for pasting a token mint or wallet address, with no credential or payment capture. Robinhood Chain appears as a supported network, not as an identity being impersonated. The 'Connect wallet' button, the '$PORTENT: launch soon' teaser and the Solana/Robinhood Chain copy mismatch on a fresh .xyz domain are worth watching as a possible drainer pivot, but they are not yet evidence of
The page impersonates a legitimate crypto-analysis tool ('PORTENT') but the forms requesting token mint addresses and wallet addresses, combined with the messaging ('A token built to take your money'), suggest a scam designed to harvest cryptocurrency wallet data or redirect users to fraudulent tokens. The 'Robinhood Chain' reference (not a real blockchain) and sealed-room form design reinforce the deceptive intent.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Friday, September 25, 2026
Same data as JSON: /api/zone/domain/portentscan.xyz. This page is not indexed by search engines and does not link to the site it describes.