web3vell[.]com

Analysis of www.web3vell.com shows a newly created domain actively used for phishing. The domain was registered through Name SRS AB and first appeared on August 26, 2025. DNS resolution points to the single IPv4 address 198.251.89.30, and the authoritative name servers are ns23.asurahhosting.com, ns24.asurahhosting.com, ns23.my-control-panel.com, and ns24.my-co, indicating reliance on shared hosting infrastructure.

VirusTotal reports that one of ninety‑one scanning engines flagged the domain, suggesting at least one security vendor has observed malicious behavior. The domain is listed on a security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing resource. Current monitoring shows the site remains active, and no public evidence of SSL certificates, HTTP status codes, or page titles has been published, leaving the exact content of the hosted page unverified.

Defenders should treat the domain as high‑risk: add the FQDN and its resolving IP to network‑level denylists, enforce DNS sinkholing, and monitor for any new sub‑domains or similar name server configurations that might be leveraged for additional campaigns. Continuous scanning of the hosting IP is recommended to detect future payloads or shifts in infrastructure, and any observed traffic to the domain should be logged for forensic correlation. Until further content analysis is available, the lack of visible page metadata does not diminish the observed malicious indicators, and the domain should be blocked across enterprise security controls.