web3[.]top

The domain web3.top is currently active and has been classified as a generic phishing site. It was registered on May 01, 2026 through a registrar located in China and resolves to the IPv4 address 13.248.169.48, which is associated with an AWS Global Accelerator node in Canada. HTTP requests return a 200 status code, indicating a live web service. Infrastructure analysis shows the domain is delegated to the Afternic name server pair ns1.afternic.com and ns2.afternic.com. The TLS certificate presented is a GoDaddy Secure Certificate Authority – G2 certificate issued to GoDaddy.com, Inc., which is commonly used by legitimate services but offers no indication of malicious intent. The domain lacks functional mail exchangers, as the MX record contains an empty host field with priority 0, suggesting email is not a primary channel. A Gridinsoft trust score of 0 out of 100 further reflects a poor reputation. Threat intelligence corroborates the phishing designation. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. AlienVault OTX includes the domain in one pulse, and VirusTotal records four detections out of ninety‑five scanning engines, confirming that multiple security products have observed malicious behavior. No additional autonomous system or brand affiliations are disclosed. Uncertainty remains regarding the specific payload or credential‑harvesting page hosted at the address, as the public data does not reveal the content served beyond the HTTP 200 response. Defenders should prioritize blocking traffic to 13.248.169.48 and adding web3.top to sink‑hole or URL filtering lists. Continuous monitoring of DNS changes, certificate renewals, and any new threat‑intel references is advised to detect possible evolution of the campaign.