web3portal[.]cyou

Analysis of web3portal.cyou indicates active generic phishing infrastructure. The domain resolves to IP 188.114.96.3, which is hosted by Cloudflare, Inc. in Canada and is served through the authoritative nameservers roman.ns.cloudflare.com and tricia.ns.cloudflare.com. Registration details show the domain was created through Gname.com Pte. Ltd., a registrar that frequently appears in abuse reports. The site returns HTTP 200 responses and presents an SSL certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS handshake but offering no protection against credential harvesting. The page title observed is “Web3Mart,” suggesting an attempt to lure victims with a web‑3 marketplace theme, though the page content has not been examined. The domain is listed on one public blocklist and is actively blocked by PhishDestroy. VirusTotal scans report three detections out of ninety‑one security vendors, reinforcing the suspicion of malicious activity. The risk rating is high and the campaign remains active as of the report date. Uncertainty remains regarding the specific payload or credential collection mechanism employed, as no page content analysis is available. Defenders should consider adding the IP address 188.114.96.3 and the domain web3portal.cyou to web filtering and DNS blocklists, monitor for related command‑and‑control patterns, and enforce TLS inspection to observe any credential submission. Ongoing tracking of the Cloudflare nameserver configuration is recommended, as adversaries may shift infrastructure while retaining the same domain registration.