web3world[.]ltd

Analysis of web3world.ltd shows a newly‑registered domain that is actively being used for a generic phishing campaign. The domain was created on July 11, 2026 and is registered through HOSTINGER operations, UAB. It resolves to the IPv4 address 5.182.208.207 and uses the maskhosting.com name servers (ns5.maskhosting.com, ns6.maskhosting.com). The hosting infrastructure is typical of low‑cost bulk registrars, offering little attribution beyond the registrar information.

The site has been flagged by PhishDestroy and appears on a single public security blocklist, indicating that at least one anti‑phishing feed has already taken action to block it. VirusTotal analysis shows that one out of ninety‑one security vendors has flagged the domain, providing a minimal but non‑zero detection signal. No additional evidence such as SSL certificates, HTTP response codes, page titles, or Safe Browsing alerts is available in the current intelligence set, leaving the surface‑level characteristics of the hosted content unverified.

The lack of further metadata means the exact phishing lures or target brands remain unknown, and investigators should treat the site as a potential credential‑harvesting portal until more detailed payload analysis is performed. Defenders are advised to add web3world.ltd to local blocklists, monitor DNS queries for the resolved IP address, and enforce strict email filtering to prevent users from receiving links that resolve to this domain. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel sharing platforms will help capture any escalation in detection counts or additional indicators of compromise.