web3hubnet[.]com

On 30 July 2025 the domain web3hubnet.com was registered through Hostinger operations, UAB. The site resolves to the IPv4 address 92.113.16.76, which belongs to AS47583 Hostinger International Limited and is geolocated in Germany. The domain presents a TLS certificate issued by ZeroSSL RSA Domain Secure Site CA, indicating a standard free certificate without extended validation. The publicly visible page title reads “Home – Web3 Hubnet – A crypto buy and sell marketplace”, and the threat profile lists the brand target as scroll, classifying the activity as a crypto‑related brand impersonation. Threat‑intelligence aggregators have flagged the domain.

VirusTotal reports a single positive detection out of 93 scanning engines, and the domain appears on six independent blocklists. Commercial trust‑scoring services assign a zero‑point rating (0/100) on Gridinsoft, reflecting an extremely low reputation. Multiple cryptocurrency‑focused security products have added the domain to their block lists, including PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt, reinforcing the assessment that the site is used to lure victims seeking to trade or purchase tokens. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is temporarily inactive.

However, the presence of a valid TLS certificate and the recent registration date indicate that the infrastructure could be re‑activated quickly. Defenders should continue to block the IP address 92.113.16.76 and the domain name at DNS and web‑filter layers, monitor for any resurrection of the site, and incorporate the domain into threat‑intel feeds. Organizations that interact with the scroll brand or that support crypto transactions should alert users to the impersonation attempt and enforce multi‑factor authentication for any wallet connections. Ongoing surveillance of the hoster’s IP range is advisable, as similar domains may be spun up using the same hosting provider.