connect[.]web3backuphub[.]com

PhishDestroy identifies active credential theft infrastructure at connect.web3backuphub.com. This domain was flagged by 9 out of 95 VirusTotal security vendors and blacklisted by Google Safe Browsing under the SOCIAL_ENGINEERING category, indicating high confidence in malicious intent. This domain was registered through Spaceship, Inc., resolves to IP 86.107.77.119, and holds a valid Let’s Encrypt SSL certificate. It was created on December 20, 2025, making it a recently deployed threat vector. The combination of low detection ratio, absence of reputation, and recent registration suggests a focused, short-lived campaign targeting Web3 users through impersonated backup services. Mitigation requires immediate avoidance of this domain and any associated links or forms. Users who may have entered credentials should revoke access to connected applications immediately and change passwords across all services using the same or similar login details. Organizations should block the domain at DNS and firewall levels and monitor for related infrastructure. Always verify URLs before entering sensitive information and use password managers that flag known phishing domains.