web3backup[.]online

Analysis of www.web3backup.online shows a domain registered on October 03, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu. The authoritative nameservers are ns1.openprovider.nl, ns2.openprovider.be, and ns3.openprovider.eu, indicating the use of OpenProvider services for DNS. DNS resolution points to IP address 35.204.150.5, which is assigned to Google LLC (AS396982) and geolocated to the Netherlands. The site presented an SSL certificate issued to Webador / by.webador.com, suggesting the use of a low‑cost web‑hosting or site‑builder platform.

An HTTP request returns a 404 status code, and the page title retrieved is simply "web3"; no further content was captured before the domain was taken offline. The domain appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans recorded four detections out of ninety‑five security vendors, confirming that multiple scanners flag the domain as malicious. The threat classification in the intelligence set is a crypto scam, aligning with the "web3" title and the observed phishing behavior.

While the offline status prevents direct observation of phishing payloads or credential‑harvesting forms, the combination of recent registration, use of reputable hosting infrastructure, a valid TLS certificate, and multiple vendor detections indicates a deliberate attempt to exploit cryptocurrency‑related interest. Defenders should continue to monitor the IP address 35.204.150.5 for any future malicious activity, enforce blocklist updates that include this domain, and consider applying sink‑hole or DNS‑filtering rules for the associated OpenProvider nameservers. Additional scrutiny of any traffic matching the domain's TLS fingerprint or HTTP 404 response pattern is advisable, as threat actors may reactivate the domain or replicate the infrastructure under a new label.