web3uadit[.]com

Analysis of the domain web3uadit.com indicates an active brand-impersonation phishing campaign targeting Google. Registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 2.27.33.89, hosted in Finland under the provider Xorek.Cloud. Infrastructure analysis reveals Cloudflare nameservers (laila.ns.cloudflare.com and malcolm.ns.cloudflare.com) and a Let's Encrypt SSL certificate issued under the E8 chain, suggesting an attempt to appear legitimate. The page title is explicitly set to 'Google,' aligning with the reported scam type of brand impersonation. Security vendor detection is notable but not unanimous: 15 of 94 engines on a recent scan flagged the domain as malicious. It appears on three independent security blocklists and is actively blocked by at least three security mechanisms, including domain reputation systems and browser-based protections. The site remains operational as of July 12, 2026, returning an HTTP 200 status, and is assessed with a trust score of 0/100 by Gridinsoft. Detected technologies include Google Web Server, HTTP/3, and HSTS, which may be employed to enhance perceived authenticity. While the domain’s exact content and attack vector remain unconfirmed, the combination of brand impersonation, recent registration, and low trust scores strongly suggests malicious intent. Defenders are advised to treat this domain as high-risk and prioritize blocking or monitoring access to it. Further investigation into associated infrastructure, such as hosting provider patterns or certificate reuse, may reveal additional linked threats.