We have already handled a userportal.space scam case: fifteen thousand euros paid, a 16,027-euro balance that could never be withdrawn, and a fake recovery demanding money for conversion, insurance and a "blockchain certificate" that does not exist. We can help you.
Note: we are a law firm dealing exclusively with online fraud. If you were caught in the same trap and want help, you can write to us using the form at the bottom of this article.
Why we say userportal.space is a scam
We have already handled the case of a client who paid around fifteen thousand euros through userportal.space, a platform reached via a login page and presented as an investment service. The first transfers date from April 2026; by the end of July the balance shown had become 16,027 euros, and it was never possible to withdraw a cent of it.
Then came the second phase, and that is mainly what this article is about: a fake recovery service that demanded money for conversion, for insurance and for a "blockchain certificate".
The generic name is not an oversight
First the name of userportal.space. "userportal" means, literally, "user portal". It is not the name of a company, an intermediary or a service: it is a system word, the one that appears above a login screen in thousands of different applications.
It is a deliberate choice and we meet it often. A completely generic name says nothing and, for that very reason, never contradicts itself: it can be presented as the portal of company X on Monday and of company Y a month later, without changing domain. It is also a name an internet search returns nothing useful for, because it coincides with thousands of legitimate pages. The anonymity of the name is part of the product.
The rule here too is the usual one: before paying money, search for the company running the service, not for the login screen.
The "blockchain certificate" does not exist
This is the point we want to explain most carefully, because it concerns a document we keep seeing and that convinces a great many people.
After the payments to userportal.space, our client was sent a "blockchain certificate" attesting to the existence and deposit of the sums. Let us say it plainly: such a document does not exist and means nothing.
The blockchain issues no certificates. It is a public ledger: anyone, at any time and free of charge, can verify that a given transaction took place, from which address to which address, for what amount and on what date. You do not need a PDF for that, you need the transaction identifier — the hash — or the destination address, to be checked on one of the many public ledger explorers.
From this follows a very simple test: if someone sends you a certificate instead of a hash, they are hiding something. A document with a letterhead, a number and a seal is exactly what gets produced when there is no transaction to show. A real transaction needs no one to certify it, because it is already public.
The same goes for "balances" visible on a platform. In our case the balance shown was 16,027 euros: but that figure sat on a web page, not on a ledger. Whoever displayed it could write whatever they liked.
Conversion and insurance
The sums demanded after userportal.space, in the second phase, came under two recurring headings: one for the conversion of the balance and one for the insurance of the sums.
Neither exists.
Conversion between currencies or crypto-assets is an operation carried out automatically, whose cost is withheld from the converted amount: it is not paid in advance, from another account, to a different party. As for insuring a balance, that is simply not a product an intermediary offers a client against a bank transfer: you do not insure "idle" capital by paying a premium to whoever holds it.
These items share the same function as the "unlocking taxes" and "withdrawal commissions" we have described in other cases: they are pretexts to extract further money from someone already hit, and they are never the last demand. After conversion comes insurance, after insurance comes a tax.
An "English recovery company"
In the final phase of the userportal.space case the contacts presented themselves as recovery agents of an English company, given as SOLVIX GROUP LTD.
We report the name because it is useful for others to recognise it, with a necessary caveat: anyone legitimately bearing or having borne a similar name does not necessarily have any connection with this case. In recovery frauds a company name is a costume, and it is chosen precisely because it sounds plausible.
The point, in any event, is not the name but the structure. No recovery of money happens by asking the victim for advance payments. No company, no law firm and no public authority operates that way. If you are asked to pay in order to receive, this is the second fraud.
The route of the money, and why it is traceable
In the userportal.space case the money followed a precise route, which our client reconstructed: from her own bank account to a regulated exchange, and from there to a destination address supplied by the fraudsters, beginning with bc1qddrvtdf and ending with aplvmn.
It is a route many victims of userportal.space and similar platforms regard as the end of all hope. The opposite is true.
The step from the account to the exchange is documented by the bank. The purchase and the transfer are documented by the exchange, which is subject to the customer due diligence and record-keeping duties of legislative decree 231/2007 and can receive requests from the judicial authority. And the subsequent transfer is entered in a public and permanent ledger, consultable by anyone, for ever.
From that address the movement of the funds can be followed and the point identified where they reach an operator required to identify its customers: that is where the account holder's details are sought. It is not a guarantee of recovery, but it is a real route, and it requires one thing only: that the addresses and transaction identifiers were kept.
What we checked on userportal.space
We found no company name, no VAT number, no registered office and no reference to any authorisation or supervisory body connected to userportal.space, and no entry in the registers kept by CONSOB, the Italian market authority, or among the EU intermediaries entitled to operate in Italy.
The public registers show that userportal.space was registered on 13 March 2026 with a European registrar, for the minimum term of one year, expiring on 13 March 2027. The registration precedes the first April 2026 payments by a few weeks.
One last check, which we always recommend: userportal.space has no mail server configured. No email can be received at that address. An entity claiming to hold other people's money and to which you cannot even write is not an intermediary.
The criminal framework
The conduct of whoever ran userportal.space amounts to fraud under article 640 of the Italian Criminal Code, aggravated under the second paragraph no. 2-bis for exploiting the circumstance of distance referred to in article 61 no. 5, and by the aggravating circumstance introduced in paragraph 2-ter by law 90/2024, applicable because the facts date from 2026.
The second phase, grafted onto userportal.space, is not a minor episode. Claiming to be an agent of a recovery company amounts to impersonation under article 494, and producing a false document such as the purported certificate is separately relevant. Since the victim had already been hit and was led to rely on a professional intervention, her reduced capacity to defend herself carries specific weight.
Also to be assessed are the aggravating circumstance of particularly serious financial harm under article 61 no. 7, the unlawful provision of investment services under article 166 of the Consolidated Law on Finance, punished by one to eight years' imprisonment, and, as regards whoever received and moved the cryptocurrency, money laundering under article 648-bis or self-laundering under article 648-ter.1. The repeated payments constitute a single criminal design under article 81, second paragraph.
Banking records can be obtained for ten years under article 119, fourth paragraph, of the Consolidated Banking Law. Aggravated fraud becomes time-barred after six years, up to seven years and six months with interrupting acts; the civil claim follows the longer term under article 2947, third paragraph, of the Civil Code. For transfers abroad the tools are the European Investigation Order under legislative decree 108/2017 and preventive seizure under article 321 of the Code of Criminal Procedure.
What to do now
Do not pay any more money to userportal.space or to anyone presenting themselves as a recovery agent, under any heading: not conversion, not insurance, not taxes. Keep every destination address and every transaction identifier: they are the evidence. Ask the exchange for a complete statement of operations and your bank for the transfer records. Do not send any further identity documents. File a criminal complaint attaching the false documents you received as well, because producing them is part of the offence.
We can help you
Our firm deals exclusively with online fraud and has already handled cases entirely comparable to userportal.space: platforms with generic names, balances that exist only on a web page, fake certificates and fake recovery companies.
If you have paid money to userportal.space or to a platform working the same way, contact us using the form at the bottom of this page: we will review the documents and tell you honestly what concrete prospects exist in your case.
You can read other comparable cases we have handled:
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
