xweb3[.]network

On 24 July 2026 analysts observed the domain xweb3.network being taken offline after detection as an elevated‑risk investment‑scam phishing site. The domain was registered on 22 March 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure, resolving to IP 188.114.96.3, which is geo‑located to Canada and served by Cloudflare, Inc. The authoritative nameservers are phil.ns.cloudflare.com and sandra.ns.cloudflare.com. No TLS certificate was presented, indicating the site operated over plain HTTP. Passive scanning identified the page title “X Token”, and fingerprinting tools detected the presence of Smartsupp live‑chat, Cloudflare Browser Insights, and HTTP/3 support, all consistent with a typical Cloudflare‑protected deployment.

Reputation checks show the domain appears on three independent security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal recorded six detections out of ninety‑four submitted scanners, confirming malicious classification by a subset of vendors. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility assessment. The site was categorized as an investment scam, targeting users with promises related to the “X Token” concept.

While the offline status prevents active probing, the lack of an SSL certificate, the recent creation date, and the low trust score suggest a short‑lived malicious campaign. Uncertainty remains regarding the exact payload delivered to victims, as no sample URLs or malicious scripts have been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP address or Cloudflare nameserver pair, and update endpoint detection rules to flag the identified Smartsupp and Cloudflare Browser Insights signatures. Ongoing collection of any malicious payloads or phishing emails referencing “X Token” will be required to refine detection and response capabilities.