# www.web3llcsafeguard.com.spacetradeinvest.com — SUSPICIOUS

> Web3 crypto phishing domain www.web3llcsafeguard.com.spacetradeinvest.com detected Dec 23 2025. Check the full report.

## Summary
PhishDestroy identifies an active Web3 cryptocurrency phishing domain posing as a safeguard portal for Web3 LLC. The domain www.web3llcsafeguard.com.spacetradeinvest.com was registered on December 23 2025 and is currently resolving to IP address 198.251.89.220. Threat actors are leveraging a misspelled subdomain and a trusted second-level domain to impersonate a legitimate Web3 security service, aiming to harvest wallet credentials and private keys from unsuspecting cryptocurrency users.  This investigation reveals a newly registered domain with zero detections on VirusTotal out of 95 engines as of the latest scan, indicating limited signature-based detection at this time. The phishing infrastructure is hosted through Global Domain Group LLC and secured with a Let’s Encrypt SSL certificate, increasing user trust. The domain has not yet been flagged on major public blocklists, suggesting it is in the early stages of deployment but remains actively operational. The domain’s naming pattern—combining 'web3', 'llc', 'safeguard' with a seemingly unrelated 'spacetradeinvest.com'—exploits cognitive bias to appear legitimate to cryptocurrency investors seeking portfolio security tools.  Users who visited www.web3llcsafeguard.com.spacetradeinvest.com are advised to immediately revoke any wallet connections or API keys exposed through the site, perform a full wallet audit, and check for unauthorized transactions. Users should also clear browser cache and cookies associated with the domain, disable any active browser extensions interacting with Web3 sites, and monitor for credential reuse across other platforms. If private keys or seed phrases were entered, consider the associated wallets compromised and transfer remaining assets to new, securely generated wallets. Report the domain to your wallet provider and relevant security platforms. Always verify URLs via official channels before entering sensitive information—especially in Web3 and crypto contexts where irreversible losses are common. PhishDestroy recommends blocking the IP 198.251.89.220 and the domain at the network level.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-12-23 08:36:23
- Registrar: Global Domain Group LLC
- IP: 198.251.89.220

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/1a552c6e-39f1-4ad9-b7b0-de98c6254e63
- PhishDestroy: https://phishdestroy.io/domain/www.web3llcsafeguard.com.spacetradeinvest.com/
- LLM endpoint: https://phishdestroy.io/domain/www.web3llcsafeguard.com.spacetradeinvest.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/www.web3llcsafeguard.com.spacetradeinvest.com/
Last updated: 2026-03-23