puncake-svvap[.]web-3[.]to

The domain puncake-svvap.web-3.to is currently active and was registered on April 24, 2026 through the Government of the Kingdom of Tonga. It resolves to IP address 178.16.53.184, which is geolocated to the Netherlands and associated with Omegatech LTD. The infrastructure runs Nginx behind Cloudflare nameservers (aron.ns.cloudflare.com, keanu.ns.cloudflare.com) and presents a Let's Encrypt R12 TLS certificate. HTTP requests receive a 302 redirect that ultimately yields a page titled "403 Forbidden." VirusTotal reports 20 of 94 security vendors flagging the domain, and the site appears on two security blocklists, with active blocking by PhishDestroy and ScamSniffer. Independent reputation services assign a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100, reinforcing the high‑risk assessment. The campaign is classified as brand impersonation targeting PancakeSwap. Content beyond the title has not been publicly disclosed, so the exact phishing tactics and any associated payloads remain unknown. Defenders should immediately block the domain and its resolving IP, enforce DNS sink‑holing for queries to the domain, and incorporate the indicator set into intrusion detection and proxy filtering rules. Continuous monitoring of TLS traffic for the Let's Encrypt certificate fingerprint is advised, as is periodic re‑scanning to detect any changes in vendor detection counts or additional blocklist listings.