web3mint[.]xyz

The domain web3mint.xyz was observed on July 12, 2026 as an active brand‑impersonation campaign targeting Google. The site presents the page title “Web3Mint” and is classified as a tech‑support scam. VirusTotal analysis shows that 5 of 95 security vendors have flagged the domain, and it appears on two external blocklists. Intelligence from AlienVault OTX references the domain in a single threat pulse. Infrastructure analysis reveals that the domain was registered on December 18, 2024 through Go Daddy, LLC and uses GoDaddy’s default nameservers ns73.domaincontrol.com and ns74.domaincontrol.com. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2, providing HTTPS with HSTS enabled. DNS resolution points to IP address 13.248.243.5, which is hosted in the United States and belongs to AS16509 Amazon.com, Inc. Observed web technologies include the GoDaddy Website Builder, RequireJS, reCAPTCHA, and Re:amaze, indicating the use of a generic site‑building platform with added bot‑mitigation. The HTTP response returns status code 200, confirming that the page is actively serving content. Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain is currently blocked by PhishDestroy and Enkrypt, reinforcing its malicious classification. Defenders should block connections to web3mint.xyz at the DNS and network layers, and add the associated IP 13.248.243.5 to threat‑intelligence feeds. Email filters should flag any messages referencing the domain or the “Web3Mint” title, especially those purporting to offer Google support. Continuous monitoring of the domain’s certificate and DNS records is advised, as changes may indicate further campaign evolution.