# PhishDestroy threat dossier — web3app.to ================================================================ Fetched: 2026-04-30 18:12:44 UTC Canonical: https://phishdestroy.io/domain/web3app.to/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: MetaMask ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 12/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, CRDF, CyRadar, Fortinet, G-Data, Gridinsoft, Kaspersky, Seclookup, SOCRadar, Sophos, VIPRE URLQuery: 4 detections Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 141.164.56.185 (KR, Seoul) ASN: AS20473 The Constant Company, LLC Hosting org: KOR VULTR Registrar: NAMECHEAP Nameservers: dns1.registrar-servers.com, dns2.registrar-servers.com Registered: 2026-04-04 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-06-26 Status: INVALID chain Fingerprint: 75bfd2da3e531745aa36aaf91d1fc6ea53332437c7ca421f13e0c3b4394d646b Subject Alternative Names (related infrastructure — often same operator): - www.web3app.to ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-04 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-04 15:22:10 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-04-04 12:29:47 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-04-23 06:05:23 UTC Neutralised: 2026-04-05 06:15:33 UTC Current status: taken down (registrar suspended or DNS dead) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d586f-9e0c-774b-a061-7c59bbf474ed/ URLQuery: https://urlquery.net/report/e2565f26-ae91-4c38-abfb-7d60ef20636b Wayback Machine: https://web.archive.org/web/*/web3app.to crt.sh CT logs: https://crt.sh/?q=%25.web3app.to Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=web3app.to AlienVault OTX: https://otx.alienvault.com/indicator/domain/web3app.to URLhaus: https://urlhaus.abuse.ch/host/web3app.to/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-04 15:24:48 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain web3app.to has been identified as a credential phishing threat targeting users of Web3 applications, currently under investigation. The domain appears to impersonate legitimate Web3-related services to lure victims into disclosing sensitive login credentials or private keys. This targeted approach classifies the threat as a specialized phishing operation rather than generic phishing. Based on the latest intelligence, web3app.to has not been flagged by any of the 95 VirusTotal vendors (0/95 detections), indicating it may be too new or uses evasion techniques. It was registered recently on March 27, 2026, through the registrar NAMECHEAP. The domain resolves to the IP address 141.164.56.185 and holds an SSL certificate issued by Let's Encrypt, which may lend it an appearance of legitimacy to unsuspecting users. Additionally, the domain has been blocked by security tools SEAL and MetaMask and appears on two separate security blocklists, confirming active recognition by threat detection systems. Currently, web3app.to remains active and under continued scrutiny. Users are strongly advised to avoid interacting with this domain, especially when prompted for any login credentials or cryptocurrency wallet information. It is recommended to rely on official Web3 app sources and to enable security solutions that block known phishing domains, such as SEAL and MetaMask. Continuous monitoring of the domain's status and updates from reputable threat intelligence services will be crucial to mitigating risks associated with this emerging Web3 phishing threat. [Updates since narrative was generated:] - VirusTotal detections: now 12/94 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260404-AE1AAA TLS cert SHA-256: 75bfd2da3e531745aa36aaf91d1fc6ea53332437c7ca421f13e0c3b4394d646b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/web3app.to/ JSON API: https://api.destroy.tools/v1/check?domain=web3app.to Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io