m[.]web3-chain[.]trade

Analysis of the domain m.web3-chain.trade shows a high‑risk investment phishing operation that remains active as of the report date, July 24, 2026. The domain was registered on February 21, 2026 through NameSilo, LLC and resolves to the Cloudflare IP address 104.21.59.68, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses Cloudflare nameservers (bayan.ns.cloudflare.com and dell.ns.cloudflare.com), and the site serves content over HTTPS with a certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain but not mitigating malicious intent. Technical fingerprints reveal the front‑end stack employs Vue.js and leverages HTTP/3 via Cloudflare’s edge network, returning an HTTP 200 status for the root page.

The page title is currently undefined, meaning the visible title has not been captured for analysis. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing vector. VirusTotal scans show three of ninety‑three security vendors flag the domain, providing additional vendor‑level corroboration. An independent Gridinsoft trust score rates the domain at 0 out of 100, indicating a lack of trust.

The known scam type is an investment scam, suggesting that victims may be lured into fraudulent financial schemes, potentially targeting cryptocurrency or token investors. While the exact content and lure mechanisms remain unconfirmed due to the missing page title, the convergence of blocklist listings, vendor detections, low trust scoring, and the investment‑scam label provides sufficient confidence for defensive action. Organizations should add the domain and its associated IP to firewall and proxy blocklists, monitor DNS queries for the listed nameservers, and flag any outbound connections to the IP as suspicious.