web-3[.]to

PhishDestroy identifies web-3.to as an active credential theft domain targeting cryptocurrency users. Although no specific brand impersonation is confirmed, it functions as a generic phishing site designed to steal user credentials, potentially for crypto draining. No specialized drainer kit is publicly confirmed, but the presence of blocking by MetaMask and SEAL indicates a clear threat to digital wallet security.

Technically, web-3.to resolves to IP address 178.16.53.184 and was created on August 25, 2025. It is registered through the Government of Kingdom of Tonga. VirusTotal analysis reveals that 15 out of 95 security vendors flag this domain, underscoring its suspicious nature. It currently appears on two security blocklists and is actively blocked by major crypto security tools like MetaMask and SEAL. The domain uses a Let's Encrypt SSL certificate, which may lend false legitimacy to unsuspecting users. The Google Safe Browsing (GSB) status is not explicitly reported but likely contributes to the elevated risk assessment.

The domain’s status remains active, with an elevated risk level due to its involvement in credential theft campaigns. Users are strongly advised to avoid any interaction with web-3.to, especially in contexts involving crypto wallets or sensitive login credentials. Security teams should maintain updated blocklists including this domain and monitor for related phishing campaigns. The blocking by leading platforms indicates effective mitigation steps are in place, but continued vigilance is necessary given the domain’s recent creation and ongoing activity.