web3-antivirus[.]net

The domain web3-antivirus.net was registered on August 24, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. It resolves to the IPv4 address 94.181.229.250, which is allocated to AS41727 JSC ER‑Telecom Holding in Russia. The domain is served by the authoritative nameservers fdomain.earth.orderbox-dns.com, fdomain.mars.orderbox-dns.com and fdomain.mercury.ord, and it does not present an SSL/TLS certificate, indicating an unencrypted HTTP service. The site’s page title, "Web3 Antivirus — Complete Web3 Security Solution," and the declared scam type of wallet/seed phishing suggest an attempt to lure cryptocurrency users into providing private keys or seed phrases.

The threat actor explicitly impersonates the 1inch brand, targeting users of that decentralized exchange aggregator. Detection evidence shows that three of ninety‑five security vendors on VirusTotal flagged the domain as malicious, and it appears on two public blocklists, specifically PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the high‑risk assessment. The elevated risk level is consistent with the observed infrastructure and the brand‑targeted phishing intent.

While the page content beyond the title has not been publicly disclosed, the available indicators are sufficient for defensive actions. Organizations should block the domain and its resolving IP at perimeter and DNS layers, update URL filtering and threat‑intel feeds to include the listed nameservers, and monitor for any re‑registration of the domain or similar variants. Continuous telemetry from endpoint and network sensors should be correlated with the three VirusTotal detections to improve detection accuracy.