web3-secure[.]org

Analysis of the domain web3-secure.org shows a high‑risk credential phishing operation that presents itself as a crypto buy‑and‑sell marketplace, as indicated by the page title "Home - WEB3-BACKUP - A crypto buy and sell marketplace." The site was registered on February 21, 2026 through Dynadot LLC and currently resolves to the IPv4 address 64.20.44.107, which is hosted in the United States under ASN 19318 (Interserver, Inc). The infrastructure employs LiteSpeed web server software, Alpine.js for client‑side rendering, and supports HTTP/3, suggesting a modern but potentially disposable hosting setup. The SSL certificate is issued by ZeroSSL ECC Domain Secure Site CA, confirming that HTTPS is offered but does not mitigate the malicious intent. The domain is listed on four security blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing its classification as a phishing vector.

VirusTotal scans record 14 detections out of 93 security vendors, providing independent confirmation of malicious behavior. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme distrust. AlienVault OTX reports the domain in one threat‑intel pulse, further linking it to known malicious activity. The domain's authoritative nameservers are vda7300a.trouble-free.net and vda7300b.trouble-free.net, which are commonly associated with disposable or compromised DNS services.

As of the report date, the site is taken offline, but the underlying IP and hosting environment remain active and could be reused for future campaigns. Defensive recommendations include adding web3-secure.org to network blocklists, monitoring the associated IP address and nameserver prefixes for new domain registrations, and updating intrusion detection signatures to flag the observed SSL issuer and the LiteSpeed/Alpine.js stack combined with HTTP/3 usage.