web3wen[.]link

The domain web3wen.link was registered on February 21, 2026 and is currently taken offline. Technical analysis shows it resolves to the IP address 172.86.98.14, which is assigned to RouterHosting LLC in the United States under ASN 14956. The site presented a TLS certificate issued by the R3 intermediate, indicating a valid certificate chain from Let’s Encrypt, but the presence of a legitimate certificate does not mitigate the malicious intent. The page title returned by the server was "Wen | No.1 NFT Exchange on Blast", directly referencing the Blast brand and suggesting an attempt to lure users seeking NFT services on that platform. The domain is classified as a crypto‑related scam and explicitly impersonates Blast, aligning with the reported brand target.

Detection data shows three of ninety‑five VirusTotal scanners flagged the domain as malicious, and the site appears on three independent security blocklists. It has also been listed by PhishDestroy, ScamSniffer, and Enkrypt, confirming that multiple threat intelligence feeds have identified it as a fraudulent resource. Although the site is offline, the infrastructure footprint—namely the hosting provider and IP address—remains observable and may be reused for future campaigns.

Defenders should immediately add web3wen.link and its resolving IP 172.86.98.14 to network deny lists and web‑filtering rules. Monitoring for newly registered domains that incorporate the "web3" prefix or reference Blast in their titles is advisable, as the naming pattern appears intentional. Security teams should also alert Blast users about the impersonation attempt, advising them to verify URLs against official Blast resources and to ignore unsolicited communications referencing the "Wen" exchange. Continuous threat‑intel feeds should be consulted for any reappearance of the domain or related indicators, and any future requests to resolve the same IP should be treated with heightened scrutiny.