# web3authbackup.com — SUSPICIOUS

> Web3AuthBackup.com is a crypto drainer phishing site impersonating Web3Auth with 0/95 VirusTotal detections. Block it now to protect wallet credentials.

## Summary
PhishDestroy identifies web3authbackup.com as an active crypto drainer phishing domain impersonating Web3Auth, a legitimate Web3 authentication provider. The site poses as an official backup portal to harvest wallet credentials and private keys. Given the absence of detection engines (0/95 VirusTotal), the domain is not yet widely flagged despite visual similarities to trusted branding. Risk assessment remains elevated due to low detection coupled with immediate operational status.  

This domain was flagged by PhishDestroy with the following indicators: VirusTotal detection count at 0/95, registered through Hosting Concepts B.V. d/b/a Registrar.eu, resolving to IP 188.114.96.3, SSL certificate issued by Google Trust Services, and a domain creation date of November 18, 2025. No presence on known blocklists has been recorded at this time, indicating early-stage deployment. Google Trust Services SSL issuance suggests use of a legitimate certificate authority, which may aid in evading browser warnings and increasing user trust.  

To mitigate exposure, users are advised to avoid visiting web3authbackup.com entirely. Block the domain and IP (188.114.96.3) at the network level using DNS filtering or firewall rules. Verify any Web3Auth-related domains directly via official channels (web3auth.io) and never trust unsolicited links or pop-ups claiming to offer wallet backups. Enable multi-factor authentication on wallets and revoke any suspicious approvals immediately. Report the domain to threat intelligence platforms and domain registrars to accelerate takedown efforts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-11-18 11:21:11
- Registrar: Hosting Concepts B.V. d/b/a Registrar.eu
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/71fe759e-1137-4217-96bd-26caf8298c6e
- PhishDestroy: https://phishdestroy.io/domain/web3authbackup.com/
- LLM endpoint: https://phishdestroy.io/domain/web3authbackup.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/web3authbackup.com/
Last updated: 2026-03-22