web3xorqvin[.]net

PhishDestroy has investigated web3xorqvin.net, a generic phishing domain that was found to be active and has since been taken offline. The domain posed a generic phishing threat, potentially designed to harvest credentials or sensitive information from unsuspecting visitors. Its exact brand impersonation target was not identified, but the domain's structure and behavior align with common phishing tactics.

Technical analysis reveals that the domain was registered through Dominet (HK) Limited, a registrar sometimes associated with lower-quality domains. The page title was "Xorqvin," and the domain was secured with a Let's Encrypt SSL certificate, which is typical for quickly set up phishing sites. AlienVault OTX data shows the domain appeared in one threat intelligence pulse, indicating some community awareness. VirusTotal flagged the domain with 3 out of 95 security vendors marking it as malicious, and it was listed on three security blocklists. The domain resolved to IP address 188.114.97.3, which is associated with Cloudflare, a common CDN provider that can be used to mask the true origin of phishing infrastructure. The domain was created on April 08, 2026, suggesting a relatively recent registration.

Currently, web3xorqvin.net is offline, meaning the phishing site is no longer accessible. However, users should remain cautious as similar domains may appear. PhishDestroy recommends avoiding any interaction with this domain or any unsolicited links. Always verify the legitimacy of websites by checking official sources. If you have visited this site or entered any personal information, change your passwords immediately and monitor your accounts for suspicious activity. Report any phishing attempts to relevant authorities.