VirusTotal
2 det.
web3nodeprotocol[.]app
Domain Security & Threat Intelligence Report
“Blockchain Lightning Node”
0
Risk Score
Data coverage
VirusTotal
2 / 95
URLQuery
no det.
OTX
no pulses
CF Radar
suspicious
URLScan
report ready
DNS blocks
none
SSL
valid, 88d
WHOIS
33d old
Screenshot
captured
Redirect chain
not probed
CDN bypass
n/a
URLQuery
no det.
URLScan
Report ↗
SSL
Let's Encrypt
Age
33d
Status
Live
DestroyList
Listed
Reports Sent
1
02
Forensic brief
Analyst brief · auto-generated
PhishDestroy has flagged web3nodeprotocol.app as an active crypto drainer impersonating a Web3 protocol node service. The site is designed to trick cryptocurrency users into connecting wallets under the guise of earning rewards or accessing exclusive features. This domain specifically targets users of decentralized finance (DeFi) platforms by mimicking legitimate blockchain infrastructure tools, a common tactic used by drainer kits to extract private keys or authorize malicious transactions. No known brand impersonation has been confirmed at this time, but the threat vector aligns with generic drainer operations observed in similar campaigns. This domain resolves to IP address 198.251.84.200 and is registered through Sav.com, LLC. The SSL certificate is issued by Let’s Encrypt, a detail often abused by threat actors to appear legitimate. The domain was created on April 13, 2026, indicating it is extremely new and likely spun up for a short-lived campaign. VirusTotal currently shows 0 detections out of 95 scanners, suggesting it remains under the radar of most threat intelligence feeds. Google Safe Browsing (GSB) status is unknown at this stage, and no blocklist counts are publicly available. These technical indicators suggest a low-profile, opportunistic campaign with high potential for evasion. PhishDestroy currently classifies this domain as active with a risk level under investigation. The generic phishing label reflects its use as a crypto drainer, though specific drainer kit signatures have not been confirmed in open sources. The domain’s recent creation and lack of detections indicate a high risk of rapid evolution or expansion. Users are strongly advised to avoid interacting with web3nodeprotocol.app and to verify any similar domains using PhishDestroy’s real-time tool. While the immediate risk is elevated due to the drainer’s targeted nature, the lack of widespread detection increases the likelihood of successful exploitation before remediation. Continuous monitoring and user vigilance are essential to mitigate potential losses.
03
Threat response pipeline
30+ Proprietary Parsers
Distributed scanning of Google Ads, SEO-manipulated results, Twitter/X, YouTube & Telegram campaigns.
Infrastructure Analysis
dnstwist & typosquatting detection.
Community Intelligence
Real-time ingestion via Telegram Bot & partner intelligence feeds.
Threat Ingested
web3nodeprotocol.app detected and queued for full analysis.
48+ Vendor Submissions
Threat data submitted to 48+ security vendors & threat-intel platforms.
Spamhaus
Cloudflare
Google Safe Browsing
Microsoft Security
VirusTotal
Netcraft
ESET
Bitdefender
Norton Safe Web
Avira
Kaspersky
Sophos
Fortinet
TrendMicro
McAfee
Forcepoint
BlueCoat
Quttera
Yandex Safe
OpenPhish
PhishTank
URLhaus
SURBL
Mimecast
Proofpoint
Webroot
Comodo
Avast
AVG
Malwarebytes
Emsisoft
F-Secure
Panda
Dr.Web
GData
ALYac
Cyren
Tencent
Rising
Baidu
ClamAV
Antiy
Acronis
AILabs
ChainPatrol
CryptoScamDB
ScamSniffer
SEAL-ISAC
Cloudflare Radar
View scan — verdict: suspicious
VirusTotal2 / 95 vendors flagged on VirusTotal.
Blocklist Detection
Found in 3 blocklists: MetaMask, PhishDestroy, SEAL.
Forensic Evidence CollectionURLScan.io, URLQuery & Cloudflare Radar — DOM snapshots, HTTP transactions, DNS & certificate data.
Registrar & Hosting Notification
Abuse report sent to Sav.com, LLC at
abuse-contact@sav.com with forensic evidence (metadata, screenshots, PDF).DestroyList Published
Added to PhishDestroy/DestroyList — open-source blocklist for wallets & extensions.
Abuse Reports Sent (1)
1 abuse reports filed; 31d 21h elapsed since first report.
ICANN Escalation — triggered on re-detection (24h+ active threat) per RAA §3.18 with full forensic evidence bundle
Open Threat Database
Real-time commits to GitHub repository & live monitoring at phishdestroy.io/live.
Social Broadcasting
Automated alerts on X, Telegram & Mastodon.
Awaiting Takedown
Domain still active — monitoring & re-reporting continues. 31d 21h since first report.
04
Evidence capture
Live Snapshot
2026-05-17 05:37 UTC
Malicious
· 2/95 engines
Domain Intelligence
Domainweb3nodeprotocol.app
Registrar
Sav.com, LLC
Sav.com, LLC
Abuse contact
abuse-contact@sav.com
IP Address
198.251.84.200
ASN
53667
Registration
2026-04-13 10:53:54 2027-04-13 10:53:54
SSL
Let's Encrypt
Hosting
Luxembourg , LU
Luxembourg , LU
Nameservers
ns6.my-control-panel.com
Page title
“Blockchain Lightning Node”
HTTP status
200
External lookups
ICANN RDAP ↗
WHOIS ↗
viewdns ↗rapiddns ↗ ICANN registrars ↗
Technical details
SSL fingerprint54d1cb017170d33b5c3c0ac28bd60837cf17330f2ff6019eaa0a358f8ed48896
URLScan UUID019d9017-61a3-70eb…
Case IDPD-20260415-626CAB
05
Registrar inaction · RAA §3.18
Egregious
7 days+
0d
:
00h
:
00m
:
00s
elapsed since first report
Sav.com, LLC — 31 days & 21 hours since the first ICANN-compliant abuse report,
1 reports submitted, the domain is still active.
ICANN RAA §3.18 co-responsibility window expired on day 1; we re-mailed at 24h, 72h and 7d thresholds with a full forensic evidence bundle (HAR + DOM + screenshots + kit hashes). The registrar has not acknowledged. Public escalation is now warranted.
Case ref
PD-20260415-626CAB
Re-file at 14d →
08
Public blocklist status
3
Listed in 3 public blocklists — confirmed by independent sources
Sources with no listing are omitted.
09
Technologies
Technologies · 6 identified
particles.js
Bootstrap
LiteSpeed
OWL Carousel
jQuery
HTTP/3
Detected via Cloudflare Radar · Wappalyzer engine
10
VirusTotal consensus
2/95
vendors flagging
Partial detection
Aggregated detection across 95 security vendors.
Per-vendor breakdown not available — view raw report on VirusTotal ↗
11
Site performance
Site performance analysis
Google PageSpeed Insights — mobile audit of web3nodeprotocol.app
84
Needs Work
Performance
FCP
2.47
First Contentful Paint
LCP
3.35
Largest Contentful Paint
CLS
0.007
Cumulative Layout Shift
TBT
0
Total Blocking Time
SI
5.76
Speed Index
12
Evidence & external reports
Security Analysis
14
Were you affected by this site?
Were You Affected?
You are not alone and there is nothing to be ashamed of. Reporting is the most
powerful weapon against fraud — your report can prevent others from becoming victims.
Chainabuse
Report crypto wallet or phishing URL
FBI IC3
Report internet crime (US)
Europol
Report cybercrime (EU)
Domain Appeal
Contest this listing
Beware of recovery scammers! No legitimate service will ask for upfront payment
to recover stolen crypto. Learn more about recovery fraud →
15
Report to your local authorities
Your country (auto-detected)
International / Other
Email template — registrar abuse
To:
abuse-contact@sav.com
Registrar: Sav.com, LLC Case: PD-PD-20260415-626CAB
16
Embed this report
17
About this report
About this report: web3nodeprotocol.app
This domain security report is maintained by PhishDestroy's automated threat-intelligence pipeline. Our system continuously monitors this domain across 95 security vendors on VirusTotal and 3 public blocklists.
The site displays a page titled “Blockchain Lightning Node”.
web3nodeprotocol.app has been flagged by 2 security vendors as of May 17, 2026.
If you believe this listing is inaccurate, you can submit an appeal. For more information about our methodology, visit our FAQ page.