web3invest[.]org

Analysis as of July 24 2026 indicates that the domain web3invest.org was registered on February 21 2026 through Hostinger operations, UAB. The site presents the page title “Web3Invest” and is classified as an investment‑scam impersonating Google. The domain resolves to the IP address 172.67.221.4, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP. Reputation services show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist.

VirusTotal data reports that one of ninety‑three scanning engines flagged the domain, and the blocklist PhishDestroy also lists it as malicious. The site’s current HTTP status is offline, suggesting that the payload has been taken down or the hosting has been terminated, but the infrastructure details remain active. Because the domain lacks an SSL certificate, browsers will flag it as insecure, which aligns with the zero trust score reported by Gridinsoft. The single blocklist entry and the solitary vendor detection indicate limited but concrete evidence of malicious intent. The impersonation of Google combined with the investment‑scam narrative suggests a social‑engineering campaign aimed at extracting funds from users who may be lured by promises of cryptocurrency or Web3 returns.

No additional indicators such as phishing kit signatures or malware hashes have been released, and the exact content of the site is not available for analysis. Defenders should update internal blocklists to include web3invest.org, enforce DNS sink‑hole rules for the associated IP address, and monitor Cloudflare‑hosted assets for any re‑use of the same IP range. Threat‑hunting teams should correlate any user‑initiated connections to 172.67.221.4 with endpoint logs and flag anomalous traffic.