web3backup.online

An HTTP request returns a 404 status code, and the page title retrieved is simply "web3"; no further content was captured before the domain was taken offline. The domain appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans recorded four detections out of ninety‑five security vendors, confirming that multiple scanners flag the domain as malicious. The threat classification in the intelligence set is a crypto scam, aligning with the "web3" title and the observed phishing behavior.

While the offline status prevents direct observation of phishing payloads or credential‑harvesting forms, the combination of recent registration, use of reputable hosting infrastructure, a valid TLS certificate, and multiple vendor detections indicates a deliberate attempt to exploit cryptocurrency‑related interest. Defenders should continue to monitor the IP address 35.204.150.5 for any future malicious activity, enforce blocklist updates that include this domain, and consider applying sink‑hole or DNS‑filtering rules for the associated OpenProvider nameservers. Additional scrutiny of any traffic matching the domain's TLS fingerprint or HTTP 404 response pattern is advisable, as threat actors may reactivate the domain or replicate the infrastructure under a new label.