onexweb3[.]com

PhishDestroy identifies onexweb3.com as an active fake Web3 wallet phishing domain designed to deceive users into entering their cryptocurrency wallet credentials or private keys. This domain mimics legitimate Web3 wallet interfaces, such as MetaMask or Phantom, to trick victims into connecting their wallets or approving fraudulent transactions. Security researchers have flagged this domain for hosting phishing pages that harvest sensitive wallet data, including seed phrases and private keys, which are then used to drain cryptocurrency funds. The threat actor behind this campaign appears to be leveraging the growing popularity of Web3 technologies to lure unsuspecting users into compromising their digital assets. This domain was flagged with the following indicators: registered through GoDaddy.com, LLC, resolving to IP 65.1.234.58, and secured with a Let's Encrypt SSL certificate. The domain was created on January 11, 2026, and currently shows 0 detections on VirusTotal out of 95 scanners, indicating it has not yet been widely recognized by security vendors. Despite the lack of detections, the domain's recent creation date and suspicious infrastructure suggest it is part of an emerging phishing campaign. Users are advised to avoid interacting with this domain and to report any suspicious activity to their security teams or trusted cybersecurity platforms. If you have visited onexweb3.com or entered any credentials, immediately disconnect your wallet from the site, revoke any unauthorized connections, and transfer remaining funds to a new wallet. Enable multi-factor authentication (MFA) where possible and scan your devices for malware. Report the domain to PhishDestroy or your organization’s security team to help mitigate further risks. Stay vigilant for similar domains mimicking Web3 wallet services and always verify URLs before entering sensitive information.