theweb3chain[.]org

On July 24, 2026, analysis of theweb3chain.org indicates that the domain is actively hosting a cryptocurrency‑related scam. The site returns HTTP 200 and presents the page title “Theweb3chain – Home”. It is secured with a Let’s Encrypt R13 certificate and serves content over HTTP/3 using LiteSpeed as the web server, with client‑side frameworks Alpine.js and Smartsupp visible in the response headers. The domain resolves to 38.97.40.99, an address owned by AS174 Cogent Communications, LLC in the United States.

Registration details show creation on 26 December 2025 through Hosting Concepts B.V. d/b/a Registrar.eu, and the domain is delegated to four nameservers (ns1‑ns4.ultahost.com). Reputation checks reveal a Gridinsoft trust score of 0 / 100 and placement on four security blocklists. Independent block‑list services including PhishDestroy, Polkadot, Enkrypt and Codeesura have already flagged the domain. VirusTotal scans report that three of ninety‑three AV engines label the domain as malicious.

The observed characteristics match the “Crypto Scam” classification supplied in the intelligence feed. No additional evidence about the specific phishing kit or targeted brand is available, and the exact content of the landing page has not been captured in this report. Defenders should block the domain at network perimeter, add the IP address 38.97.40.99 to deny lists, and monitor for related C2 traffic. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the payload or additional detections.