web3vaultconnect[.]com

The domain web3vaultconnect.com was registered on February 21, 2026 through DreamHost, LLC and is currently listed as offline. Technical inspection shows the site used a Let’s Encrypt R12 certificate, indicating HTTPS was offered at the time of capture. DNS resolution points to IP address 148.72.153.160, which belongs to AS30083 velia.net and is geolocated in the United States. The host was observed serving content over HTTP/3 and employing Alpine.js on the front end.

Nameserver delegation includes dns1.afeeshost.ltd, dns2.afeeshost.ltd and dns3.afeeshost.com. The page title returned by the server reads “Home - Web3vaultconnect - A crypto buy and sell marketplace”, matching an investment‑style scam narrative. VirusTotal scanned the domain and recorded two positive detections out of ninety‑three security vendors, confirming the presence of malicious indicators. Independent blocklist feeds have added the domain to six security blocklists, and it is actively blocked by services such as PhishDestroy, MetaMask, Polkadot, SEAL and Enkrypt.

While the offline status prevents real‑time interaction, the combination of a recent registration date, a cryptocurrency‑focused title, a valid SSL certificate, and multiple vendor detections strongly suggests the domain was used for an investment‑type phishing campaign. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because the site content has not been publicly archived. Defenders should continue to block the domain at network perimeter, add the associated IP address to deny‑list rules, monitor for any re‑registration attempts, and watch for similar naming patterns that reference “web3” or “vault” in conjunction with crypto trading terminology. Ongoing threat intelligence collection is recommended to capture any future resurrection of the site or related infrastructure.