web3protocolfix[.]pro

Analysis of web3protocolfix.pro shows a newly registered domain (created 21 Feb 2026) that is already being used for an investment‑focused phishing campaign. The site resolves to 188.114.96.3, an address owned by Cloudflare (AS13335) and hosted in the United States. DNS is managed through Cloudflare’s authoritative nameservers gene.ns.cloudflare.com and keaton.ns.cloudflare.com, and the HTTP service presents HSTS and HTTP/3 support, indicating a modern server stack built on Node.js and Express. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that the connection is encrypted but does not validate the site’s legitimacy.

Access attempts return HTTP 403, and the only visible page title is “Just a moment…”, a generic placeholder often used to hide malicious content behind a challenge page. Reputation checks show a Gridinsoft trust score of 0 / 100 and two of ninety‑five VirusTotal scanners flag the domain, while it is listed on at least one public phishing blocklist and has been actively blocked by the PhishDestroy service. The registrar listed is NiceNIC International Group Co., Limited. The evidence points to a high‑risk, active phishing infrastructure targeting investors, but the exact payload, credential‑harvesting forms, and targeted brands remain unknown because the page content has not been disclosed.

Defenders should immediately block network traffic to 188.114.96.3 and add web3protocolfix.pro to URL filtering and endpoint allow‑list exceptions. SOC analysts should monitor DNS queries for the domain and its Cloudflare nameservers, and threat‑intel teams should enrich the indicator set with the observed SSL fingerprint and HTTP 403 response pattern. Because the site uses a legitimate Cloudflare front‑end, detection rules that rely solely on IP reputation may miss future relays; correlation with the specific page title “Just a moment…” and the low Gridinsoft score can improve detection.