web3llcsafeguard[.]com[.]spacetradeinvest[.]com

This domain, www.web3llcsafeguard.com.spacetradeinvest.com, was observed hosting a crypto‑focused phishing page titled “Home - Web3 connects - A crypto buy and sell marketplace”. The site was taken offline prior to the report date of 25 July 2026, but infrastructure artifacts remain. DNS resolution points to the IPv4 address 198.251.89.220, which is registered to a Luxembourg‑based entity identified as FranTech Solutions. The domain was registered on 23 December 2025 through Global Domain Group LLC, indicating a relatively recent creation window. No TLS certificate was presented, leaving the service exposed to clear‑text interception.

Web server headers reveal the use of LiteSpeed and HTTP/3, while client‑side code includes Alpine.js and the Smartsupp live‑chat widget, a combination often seen in low‑cost phishing kits. The authoritative name servers are ns27.asurahosting.com, ns27.my-control-panel.com, ns28.asurahosting.com and ns28.my-co, suggesting reliance on a shared hosting environment. Reputation checks show that 12 of 94 VirusTotal scanners flagged the domain, and it appears on a single external blocklist. Gridinsoft assigned a trust score of 0 / 100, and the domain is listed as blocked by PhishDestroy. These signals collectively indicate a high confidence of malicious intent.

The primary uncertainty lies in the current activity of the hosting IP; while the site is offline, the IP may still be reused for other malicious payloads. Defenders should therefore add the domain and its IP address to deny‑list rules, monitor traffic for any residual connections, and ensure that any cached content is purged from internal proxies. Continuous observation of the hosting provider’s IP range is advised, as the lack of SSL and the presence of a generic crypto marketplace title are consistent with credential‑harvesting campaigns targeting cryptocurrency investors.