webapi[.]chainweb[.]vip

On 2026-08-02 the domain webapi.chainweb.vip was observed as active with a high risk rating for generic phishing. VirusTotal reports that nine out of ninety‑one scanning vendors have flagged the domain, indicating a moderate level of detection across multiple engines. Google Safe Browsing classifies the site under social engineering, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. DNS lookup returns no nameserver information (NS_NOT_FOUND), which may point to use of privacy‑focused DNS services or a misconfiguration that hides the authoritative servers.

The domain resolves to the IPv4 address 134.122.204.205; no additional IP aliases or CDN front‑ends were identified, suggesting a single‑host deployment that could be leveraged for phishing payload delivery. No SSL/TLS certificate details, HTTP status codes, page titles, or brand references are currently available in the intelligence feed, limiting visibility into the content served by the host. The lack of visible nameserver data and the absence of publicly shared page metadata impede a full content‑level assessment, but the existing indicators—multiple vendor detections, Safe Browsing social‑engineering flag, and inclusion on PhishDestroy’s blocklist—provide sufficient evidence to treat the domain as malicious. Defenders should add webapi.chainweb.vip to DNS‑based deny lists and block outbound traffic to 134.122.204.205 at network perimeters.

Continuous monitoring of the IP address for new associations is advised, as the host could be repurposed for additional phishing campaigns. Where possible, incorporate the domain into endpoint protection rules that reference the VirusTotal detection count. Because the site’s hosting infrastructure appears minimal, takedown requests to the upstream provider may be effective, but the lack of registrar and nameserver details could complicate attribution.