web3conn[.]com

Analysis of web3conn.com shows a newly registered domain (creation date November 01, 2025) that has been linked to an investment‑type phishing campaign. VirusTotal records indicate that three of ninety‑five security vendors have classified the domain as malicious, and AlienVault OTX references the domain in a single threat‑intelligence pulse. The domain appears on four independent security blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Infrastructure data reveals that the domain resolves to the IP address 198.18.1.124 and is hosted without an SSL certificate, meaning all traffic would be unencrypted HTTP.

The authoritative name servers are ns5.asurahosting.com, ns6.asurahosting.com, ns5.my-control-panel.com, and ns6.my-control-panel.com. Registration was performed through Ultahost, Inc., and the Gridinsoft trust score is 0 out of 100, indicating an extremely low reputation. Current monitoring shows the domain is taken offline, but the historical presence on blocklists and the low trust score suggest it may be re‑activated or used in a similar fashion by related actors.

Defenders should ensure that web3conn.com and its resolving IP 198.18.1.124 are denied in outbound and inbound filtering policies, confirm that no residual DNS entries remain cached in internal resolvers, and add the domain to any custom threat‑intel feeds. Continuous observation of Ultahost, Inc. registrations is advised, as the registrar has been associated with other malicious infrastructure. Given the elevated risk rating, security teams should also review any recent user reports of unsolicited investment offers that reference the domain and consider proactive user awareness messaging about potential investment scams.