okweb3dq[.]com

Analysis of the domain okweb3dq.com indicates that it was created on 21 February 2026 and is presently taken offline. The site was hosted behind Cloudflare (AS13335) and resolved to the IP address 172.67.132.113 in the United States. The TLS certificate was issued by Google Trust Services under the WE1 name, confirming use of a legitimate certificate authority. Passive fingerprinting revealed a stack consisting of Java, Apache Tomcat, MariaDB, jQuery, Skolengo, and Cloudflare Browser Insights, with HTTP/3 enabled. The page title returned by the server was “StablizEX‑Individuals”, which does not correspond to a known legitimate brand, and the registrar listed as Gname.com Pte. Ltd. The domain received a Gridinsoft trust score of zero out of one hundred, indicating a high confidence of malicious intent.

Threat intelligence sources flag the domain as an investment‑type phishing campaign. VirusTotal recorded detections from 13 of 93 scanned security vendors, and the site appears on four independent blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL. Google Safe Browsing also classifies the URL as social‑engineering. The combination of multiple vendor detections, blocklist listings, and a zero trust score supports the conclusion that the domain was used to lure victims into fraudulent investment schemes. Uncertainty remains around the exact content delivered to end users, because the site is offline and no page capture is available.

Additionally, while the technology stack suggests a typical web application, no evidence has been found linking the site to a specific financial platform or to compromised credentials. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP address or Cloudflare name‑server pair, and add the associated IP to internal threat‑intel feeds.