web3pairlinks[.]com

web3pairlinks.com entered the PhishDestroy evidence set on Feb 26, 2026. The stored content classification is investment scam. The assembled evidence scores 100/100 (critical).

Six independent sources are positive: VirusTotal, Polkadot, Enkrypt, Codeesura, PhishStats, and Cloudflare Radar. VirusTotal recorded 18 detections among 93 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, DNS8, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, Netcraft, Seclookup, SOCRadar, Sophos, Trustwave, VIPRE on Jul 18, 2026 at 20:45 UTC. Polkadot, Enkrypt, and Codeesura listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. PhishStats matched the domain in 3 feed records (source score 6) on Mar 8, 2026 at 04:30 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. The evidence is not unanimous. AlienVault OTX listed 3 community pulse references (not vendor detections) on Mar 1, 2026 at 02:15 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:49 UTC. URLScan completed without a malicious verdict (score 0) on Mar 26, 2026 at 11:14 UTC.

HTTP 525 server error was recorded on Aug 7, 2026 at 10:30 UTC. Registration records for the domain list Cosmotown, Inc. as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 188.114.96.3 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. Captured page title: “Index of /”. DOM analysis completed on Jul 21, 2026 at 02:20 UTC; stored DOM score 0/100. The evidence archive retains 1 visual capture from PhishDestroy. IoC extraction completed on Jul 29, 2026 at 02:28 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists R13 as the certificate issuer with validity through Sep 1, 2026.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as investment scam.