com-v3[.]to

The domain com-v3.to was registered on March 10, 2026 through the Government of Kingdom of Tonga and is currently resolved to the IPv4 address 178.16.52.131, which belongs to AS202412 (Omegatech LTD) located in Germany. The site was served by Nginx and protected with a Let’s Encrypt R12 certificate, indicating that TLS was active at the time of observation. Reputation data show that ten of ninety‑five VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent. The domain appears on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of a phishing‑related campaign.

The page title returned by the web server is “Application placeholder”, providing no further insight into the content or targeted brand. Nameserver configuration points to Cloudflare (damian.ns.cloudflare.com, kate.ns.cloudflare.com). The domain’s current status is offline, which may indicate takedown or temporary suspension. Uncertainty remains regarding the specific victim profile or the exact phishing payload, as no landing page content, credential‑stealing forms, or brand impersonation details have been disclosed.

Consequently, automated detection systems should continue to treat any future resolution of com-v3.to as suspicious, especially if TLS certificates are re‑issued or if the IP address changes. Defenders are advised to add the IPv4 address 178.16.52.131 to network‑level deny lists, monitor DNS queries for the domain and its Cloudflare nameservers, and enforce existing web‑filtering rules that block known phishing sites. Continuous monitoring of VirusTotal, blocklist feeds, and threat‑intel platforms for re‑appearance or new indicators will help maintain situational awareness.