# PhishDestroy domain threat record: pay-web3.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/pay-web3.com/ Machine-readable companion: https://phishdestroy.io/domain/pay-web3.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-23 17:41:19 UTC - Stored record updated: 2026-10-23 18:30:15 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.57.72 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 302 - Registration date in stored WHOIS data: 2026-09-29 11:25:36 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a14fb2-f291-70fd-803b-fbdf6d99bdb3/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/pay-web3.com - Certificate Transparency search: https://crt.sh/?q=%25.pay-web3.com - Web Archive lookup: https://web.archive.org/web/*/https://pay-web3.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed pay-web3.com as a suspicious domain based on an admin report that noted insufficient page content for analysis. The domain was first seen by PhishDestroy on 2026-10-23. A request on that date returned HTTP 200 from the apex domain, while a separate check observed a 302 redirect to www.google.com. The page metadata reported a title of "Google". How the scam works The current listing does not confirm any specific fraud technique; it only indicates that the domain is considered suspicious. In general, such domains can be used for phishing, credential harvesting, or redirecting users to legitimate sites to mask malicious intent, but no concrete behavior was observed on this page. Evidence VirusTotal scanned the domain on 2026-10-02 (retrieved 2026-10-23) and reported 0 malicious or suspicious detections out of 92 engines. Google Safe Browsing checked on 2026-10-23 and did not flag the domain. OTX recorded 0 pulses on 2026-10-23. urlscan captured the site on 2026-10-18, assigning a malicious tag with a score of 53 but an overall verdict of not malicious. No external blocklists listed the domain, and PhishDestroy internal blocklist marks it as true. Infrastructure The domain was registered on 2026-09-29 with NICENIC INTERNATIONAL GROUP CO., LIMITED and carries clientDeleteProhibited and clientTransferProhibited status. The recorded DNS entries listed Cloudflare IPs 104.21.57.72 and 172.67.161.120, with the network identified as Cloudflare, Inc. in Canada. TLS is provided by a Let's Encrypt certificate valid from 2026-09-29 to 2026-12-28. Open ports include 80, 443, and 8080, and DNSSEC is not enabled. What to do Treat the site as suspicious; do not enter credentials, wallet information, or personal data. If any credentials were submitted, change the associated passwords immediately. Security teams should add pay-web3.com to blocklists and monitor network logs for connections to its recorded IP addresses. No wallet‑related remediation is required because wallet recommendations are disabled for this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a14fb2-f291-70fd-803b-fbdf6d99bdb3/ Cloudflare Radar report: https://radar.cloudflare.com/scan/8aa90846-366d-4711-a7e8-2c309e2bbece Stored capture screenshot: https://urlscan.io/screenshots/01a14fb2-f291-70fd-803b-fbdf6d99bdb3.png Cloudflare Radar screenshot (2026-10-23T17:44:07Z): https://screenshots.phishdestroy.io/cf/8aa90846-366d-4711-a7e8-2c309e2bbece.png URLScan screenshot (2026-10-23T17:42:06Z): https://screenshots.phishdestroy.io/us/01a169da-efb6-72be-a2e9-a229ddfd3db9.png URLScan capture report: https://urlscan.io/result/01a169da-efb6-72be-a2e9-a229ddfd3db9/ VirusTotal report: https://www.virustotal.com/gui/domain/pay-web3.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pay-web3.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 17:45:09 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a14fb2-f291-70fd-803b-fbdf6d99bdb3.png Captured: 2026-10-23 17:41:19 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a14fb2-f291-70fd-803b-fbdf6d99bdb3.png Source report: https://urlscan.io/result/01a14fb2-f291-70fd-803b-fbdf6d99bdb3/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8aa90846-366d-4711-a7e8-2c309e2bbece.png Captured: 2026-10-23 17:44:07 UTC Source report: https://radar.cloudflare.com/scan/8aa90846-366d-4711-a7e8-2c309e2bbece SHA-256: 6a3b3b6af8049662ac10fb07de0f89d0f82a00224597518f6a2e62190b6a4588 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169da-efb6-72be-a2e9-a229ddfd3db9.png Captured: 2026-10-23 17:42:06 UTC Source report: https://urlscan.io/result/01a169da-efb6-72be-a2e9-a229ddfd3db9/ SHA-256: e1f3f604b61d1e5ee30692f10e9794b84ed5a0b5eeda178ad989ac8d110a1ad3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T17:44:30Z", "uuid": "01a14fb2-f291-70fd-803b-fbdf6d99bdb3", "scanned_at": "2026-10-18T15:48:16Z", "final_url": "https://pay-web3.com/", "status": 525, "ip": "172.67.161.120", "ips": [ "172.67.161.120" ], "asns": [ "13335" ], "link_domains": [ "www.cloudflare.com", "developers.cloudflare.com" ], "doc_hash": "e2e1281576a388090ecfc6cc6e1370749b17a597eba577fba9e407e87c6dd7ef", "tls": { "san": [ "*.pay-web3.com", "pay-web3.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "pay-web3.com", "protocol": "QUIC", "valid_to": "2026-12-28T12:29:23Z", "valid_from": "2026-09-29T12:29:24Z" }, "domain_age_days": 1264, "apex_age_days": 1264, "tls_age_days": 19, "tls_valid_days": 89, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 53, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T17:44:32Z", "uuid": "8aa90846-366d-4711-a7e8-2c309e2bbece", "scanned_at": "2026-10-23T17:44:07Z", "final_url": "https://www.google.com/", "status": 200, "redirected": "off-domain", "history": [ { "url": "https://pay-web3.com/", "status": 302 }, { "url": "https://www.google.com/", "status": 200 } ], "dom_hash": "a48a94e8184da80b36942049743da4793a68df42dcd56c612606b2daaa33dcbc", "doc_hash": "6e20951575198dc2c6f2b973ff557fb95067ef412394c7ffda960570e8d4b67a", "domain_risks": [ "News, Portal & Search", "Technology", "Search Engines" ], "radar_rank": { "rank": 1, "bucket": "200" }, "dns": [ { "name": "ogads-pa.clients6.google.com", "type": "A", "value": "142.250.180.10" }, { "name": "ogads-pa.clients6.google.com", "type": "AAAA", "value": "2a00:1450:400e:810::200a" }, { "name": "play.google.com", "type": "A", "value": "142.251.153.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.154.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.155.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.152.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.151.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.156.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.157.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.150.7" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:482a:700::" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:4826:700::" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:4828:700::" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:482b:700::" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:4829:700::" } ], "dnssec_valid": false, "ip": "142.251.153.119", "whois": { "registrar": "MarkMonitor Inc.", "created": "1997-09-15T04:00:00Z", "updated": "2019-09-09T15:39:04Z", "expires": "2028-09-14T04:00:00Z", "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T17:43:46Z", "analysis_at": "2026-10-02T18:02:57Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-09-29T13:25:36Z", "expires": "2027-09-29T13:25:36Z", "updated": "2026-09-29T13:25:36Z", "first_seen": "2024-03-06T04:22:30Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.57.72" }, { "ttl": 21600, "type": "NS", "value": "sunny.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::ac43:a178" }, { "ttl": 21600, "type": "NS", "value": "martin.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "martin.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:3948" }, { "ttl": 300, "type": "A", "value": "172.67.161.120" } ], "dns_at": "2026-10-02T18:08:29Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.pay-web3.com", "pay-web3.com" ], "issuer": "Let's Encrypt / YE2", "serial": "605d0e7e5f0292177e921af94b5c9a2a41d", "sha256": "7852ee32abe589e0c8b5204aa36f7e477815511d8df8c16c183a512a71b50a19", "subject": "pay-web3.com", "valid_to": "2026-12-28T12:29:23Z", "valid_from": "2026-09-29T12:29:24Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-09-29T13:25:36Z", "updated": "2026-09-29T13:25:36Z", "expires": "2027-09-29T13:25:36Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "martin.ns.cloudflare.com", "sunny.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-09-29T13:25:36Z", "registration": "2026-09-29T13:25:36Z", "registrar expiration": "2027-09-29T13:25:36Z", "last update of RDAP database": "2026-09-29T13:25:36Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T17:44:47Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "pay-web3.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-09-29T14:51:12Z", "first": "2026-09-29T14:51:12Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 904 }, "social_tags": { "title": "Google" }, "trackers": { "requests": 40, "trackers": [ { "name": "Google Play Services", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 4 }, { "name": "Google Beacons", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 10 } ] }, "mixed_content": { "no_sri": [ "https://www.gstatic.com/og/_/js/k=og.asy.en_US.lLriHBky4GQ.2019.O/rt=j/m=_ac,_awd,ada,lldp,qads,abld/exm=/d=1/ed=1/rs=AA2YrTvlez_VOYUwMtsdHrMLk1ADNVk_Vg" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 302, "timings": { "dns": 1, "tls": 35, "wait": 245, "connect": 7, "download": 0 }, "response_ms": 288 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 297608, "co2_grams": 0.0109, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "108.162.194.166", "host": "sunny.ns.cloudflare.com" }, { "ip": "162.159.44.87", "host": "martin.ns.cloudflare.com" } ], "zone": "pay-web3.com" }, "cookies": { "cookies": [ { "name": "SEARCH_SAMESITE", "same_site": "Strict" }, { "name": "AEC", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "NID", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__Secure-STRP", "secure": true, "same_site": "Strict" }, { "name": "__Secure-ENID", "secure": true, "http_only": true, "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3033::6815:3948", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "pay-web3.com" }, "dns": { "A": [ "172.67.161.120", "104.21.57.72" ], "NS": [ "martin.ns.cloudflare.com", "sunny.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"martin.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416229971, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3030::ac43:a178", "2606:4700:3033::6815:3948" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": "0", "permissionsPolicy": "unload=()", "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": "same-origin-allow-popups; report-to=\"gws\"", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2606:4700:3030::ac43:a178", "family": 6 }, "redirects": { "chain": [ "https://pay-web3.com", "https://www.google.com/" ], "count": 1 }, "subdomains": { "count": 1, "subdomains": [ "www.pay-web3.com" ] }, "linked_pages": { "external": [ "https://about.google/", "https://store.google.com/DE", "https://mail.google.com/mail/&ogbl", "https://www.google.com/imghp", "https://www.google.de/intl/de/about/products", "https://accounts.google.com/ServiceLogin", "https://www.google.com/webhp", "https://support.google.com/websearch/answer/106230", "https://www.google.com/intl/de_de/ads/", "https://www.google.com/services/", "https://google.com/search/howsearchworks/", "https://sustainability.google/intl/de/klimaschutz/", "https://policies.google.com/privacy", "https://policies.google.com/terms", "https://www.google.com/preferences", "https://consent.google.com/d", "https://support.google.com/websearch/", "https://policies.google.com/technologies/cookies", "https://policies.google.com/privacy", "https://policies.google.com/terms" ], "external_count": 20, "internal_count": 3 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-09-29T13:25:36Z", "updated": "2026-09-29T13:25:36Z", "expires": "2027-09-29T13:25:36Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "martin.ns.cloudflare.com", "sunny.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "gws", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "permissions-policy": "unload=()", "cross-origin-opener-policy": "same-origin-allow-popups; report-to=\"gws\"" } } } } ```