crypto-web3vault[.]com

This domain, crypto-web3vault.com, returns HTTP 200 and serves a TLS certificate issued by Let’s Encrypt (R13). The site’s title advertises “Home – Crypto-Web3Network – A crypto buy and sell marketplace,” indicating an unsolicited cryptocurrency investment front. Infrastructure analysis shows the domain resolves to 208.98.35.172, hosted in the United States under AS46844 Sharktech. The registrar is Cosmotown, Inc., and the domain was created on 4 Sept 2025. Nameserver delegation uses ns1‑ns3.site4now.net. Detected server stack includes Windows Server with IIS, PHP, MySQL, WordPress, Bootstrap, and front‑end components Smartsupp and OWL Carousel. VirusTotal reports two of ninety‑five scanners flagging the domain, and it appears on four external blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura). Scamadviser assigns a trust score of 36 / 100, reflecting low reputation. The evidence points to an active generic phishing infrastructure targeting cryptocurrency investors. However, the exact payload, credential‑harvesting mechanisms, and any post‑compromise activity have not been publicly observed. Defenders should block the domain and its resolving IP at network perimeter, monitor DNS queries for the listed nameservers, and consider adding the host to threat‑intel feeds. Ongoing observation of traffic to the associated IP and periodic re‑scans are recommended to capture any evolution of the malicious content.