# web3chain-security.com — MALICIOUS

> web3chain-security.com poses as a security site but pushes phishing scams. Avoid this domain after VirusTotal 5/95 vendor detections. Reported by 3 blocklists.

## Summary
PhishDestroy identifies web3chain-security.com as a live phishing domain masquerading as a blockchain security portal to harvest wallet credentials. This impostor site was created on December 01, 2025, just days ago, and already 5 out of 95 VirusTotal security vendors flag it as malicious. TuringSign Inc. d/b/a Cosmotown registered the name, and its hosting IP 163.61.188.7 has been blacklisted by Polkadot, Codeesura, and Enkrypt, accumulating a total of three independent blocklist entries. A Let’s Encrypt SSL certificate lends a veneer of legitimacy while the domain steers victims toward counterfeit security scans that exfiltrate seed phrases and private keys.  Attackers use web3chain-security.com in spear-phishing e-mails claiming “urgent security alerts” for popular wallets. Clicking the link loads a spoofed Metamask or Phantom interface that logs every keystroke, capturing recovery phrases directly. DNS lookups resolve to the single IP 163.61.188.7 across multiple autonomous systems, indicating a lightweight, disposable infrastructure designed for quick takedowns. The domain’s age, low detection count ratio, and multi-vendor blocking profile place its risk at elevated despite the small raw numbers.  If you visited web3chain-security.com, assume your browser may have been compromised. Immediately revoke any connected wallet permissions via your wallet’s official settings page, then transfer remaining assets to a newly created wallet with a hardware device. Clear browser cache and cookies, run an offline malware scan, and consider rotating all API keys and credentials entered while on the site. Report the incident to your wallet provider and file a complaint with Cert-Police or Chainalysis to aid in domain shutdown.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-12-01 11:59:42
- Registrar: TuringSign Inc. d/b/a Cosmotown
- IP: 163.61.188.7

## Detection Status
- VirusTotal: 5 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["Polkadot", "Codeesura", "Enkrypt"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/d4d0b46c-8c41-463f-941d-681e8f1ee402
- PhishDestroy: https://phishdestroy.io/domain/web3chain-security.com/
- LLM endpoint: https://phishdestroy.io/domain/web3chain-security.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/web3chain-security.com/
Last updated: 2026-03-31