Cracked crypto wallet with classified breach data and surveillance feed overlay.

Domain dossier / preserved indicators

Redacted domain dossier, minus the house style

We are far too editorially nervous to tell you whether the upstream publisher is correct. We can, however, preserve the dossier, keep the indicators readable, and route every external exit through the source gate.

Domain fileIndicators preservedSource gate wrapped

Open source gate Archive FAQ Registrar ledger

File /domain/d1-oTK5Yz-8oENAlziE/·Source voice preserved·Brand labels redacted

THE ENABLERS REGISTRY AI

HIGH

This domain, web3pool[.]lol, is flagged as a brand impersonation threat designed to exploit users by mimicking LEI:5493004F7TI6QBM4WX72, a well-known cryptocurrency platform. The site falsely presents itself as the 'LEI:5493004F7TI6QBM4WX72 Mining Pool,' a service that does not align with LEI:5493004F7TI6QBM4WX72’s official offerings. Brand impersonation of this nature typically aims to deceive users into disclosing sensitive information, such as wallet credentials or private keys, or to facilitate unauthorized transactions. Given the domain’s association with cryptocurrency services, the risk of financial loss or unauthorized access to digital assets is elevated, particularly for users unfamiliar with LEI:5493004F7TI6QBM4WX72’s legitimate infrastructure. Analysis indicates that web3pool[.]lol was registered on April 04, 2023, through [REDACTED], a registrar frequently associated with low-reputation domains. The domain resolves to the IP address 172.67.181.172, which has been linked to other suspicious or malicious activities. Security vendors have flagged this domain, with 4 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on three security blocklists, further corroborating its classification as a threat. The combination of a recent creation date, a high-risk registrar, and detection by multiple security sources underscores the domain’s fraudulent nature. Users who have visited web3pool[.]lol or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any wallets or accounts that may have been linked to the site. Review recent transactions for unauthorized activity and revoke any suspicious permissions granted to decentralized applications. If credentials or private keys were entered, consider migrating funds to a new wallet and monitoring the original wallet for signs of compromise. Additionally, scan local devices for malware, as brand impersonation sites may distribute malicious payloads. Reporting the domain to relevant security communities or blocklist providers can help prevent further exploitation of other users.

VirusTotal

4 det.

DNS Security

3/12

URLScan

Report ↗

Gridinsoft

0/100

SSL

Invalid

Age

4 mo

Observed status

Content unavailable

DestroyList

Listed

Data coverage VirusTotal 4 / 94 URLQuery no detections OTX no pulses CF Radar no data URLScan report ready DNS blocks 3/12 SSL invalid WHOIS 4 mo old Screenshot not captured Redirect chain not probed Gridinsoft 0/100

Network Security Intelligence Registrar Integrity Alert

Registrar Integrity Alert

This domain is registered via IANA #1479 — a registrar that publicly lies, shields scammers, and retaliates against researchers.

IANA #1479 was documented protecting a $20M+ Monero-theft operation ([REDACTED][.]com) across ten continuous years while publicly denying abuse reports that THE ENABLERS REGISTRY personally filed 20+ times. When we published the evidence, IANA #1479’s response was to get our X account banned — on a justification X’s own automated review later called “no violation.”

Publicly lied about receiving abuse reports — 20+ notices sent by us over 3 years with preserved delivery receipts.
Shielded a $20M+ theft operation for 10 years behind bulletproof DDoS-Guard infrastructure.
Retaliated against researchers by weaponizing X’s abuse channel to silence our account.
Offered to help remove VirusTotal detections for a known possibly phishing domain — on record.

Advisory for researchers, journalists & victims

Expect active deception from IANA #1479 — not merely abuse-report indifference, but false statements about how many reports they received. After exposure, they will typically claim no reports existed and pressure platforms to remove your published evidence.

Always CC a second authority (compliance@icann.org, sponsoring TLD registry, or CERT/LEA) on every abuse ticket.
Preserve delivery receipts — SMTP return-paths, auto-responder confirmations, ticket IDs.
Archive publicly before publishing — Wayback Machine, [REDACTED].

Read: How IANA #1479 Got Our Twitter Banned The $20M [REDACTED] Case

DNS Provider Blocks 3 / 12

Controld Adblock Controld Family Controld Malware

SSL Certificate Invalid

SSL certificate is invalid or expired. Issuer:

Threat Response Pipeline

Discovery

Checks

Reports

Availability

15/15

Pre-emptive Discovery & Ingestion

Threat Ingested

1/1 ✓

Threat Ingested

web3pool.lol detected and queued for full analysis

Apr 04, 2026

Threat Intelligence Checks

IANA #1910 Radar · VirusTotal · Google Safe Browsing · Blocklist Detection · DNS Security Blocks · Registrar Warning: IANA #1479 · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · VT Detection +1

10/10 ✓

IANA #1910 Radar

Scanned via IANA #1910 Radar — DNS, certificates & network data

VirusTotal

4 / 94 vendors flagged on VirusTotal

Jun 26, 2026

Google Safe Browsing

Checked via Google Transparency Report

Jun 26, 2026

Blocklist Detection

Found in 2 blocklists: [REDACTED], [REDACTED]

Jul 23, 2026

DNS Security Blocks

Blocked by 3 of 12 DNS providers: Controld adblock, Controld family, Controld malware

Registrar Warning: IANA #1479

Caught publicly lying to protect scam clients & offering VT detection removal. Read investigation

Brand Impersonation

Impersonation of LEI:5493004F7TI6QBM4WX72

Forensic Evidence Collected

Stored evidence from URLScan.io, stored screenshot

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Jul 23, 2026

VT Detection +1

+1 new detection (3 → 4): CRDF

Jun 26, 2026

Notification Records

Abuse Reports Sent

1/1 ✓

Abuse Reports Sent

Abuse report sent to registrar [REDACTED], hosting provider, 1 abuse contact

Apr 04, 2026

Publication & Availability

DestroyList Published · Content Observed Unavailable · Time to First Unavailability

3/3 ✓

DestroyList Published

Listed in the public THE ENABLERS REGISTRY/DestroyList repository

Apr 04, 2026

Content Observed Unavailable

The latest stored checks indicate that the reported content is unavailable; this does not establish who or what caused the change

Apr 23, 2026

Time to First Unavailability

442 hours elapsed from detection to the first unavailable observation

Public Blocklist Status

Confirmed in 3 datasets: THE ENABLERS REGISTRY + 2 independent public blocklists — [REDACTED], [REDACTED]

10 external threat databases checked; 2 matched. Last synchronized Jul 23, 2026. THE ENABLERS REGISTRY database match: confirmed.

Redacted domain dossier, minus the house style

This domain is registered via IANA #1479 — a registrar that publicly lies, shields scammers, and retaliates against researchers.

Threat Response Pipeline

Public Blocklist Status

Evidence Capture

Domain Intelligence

VirusTotal Analysis

Evidence & External Reports

Were You Affected by This Site?

Report to Your Local Authorities

Related Domain Reports

More Domains at IANA #1479 6 flagged

Other LEI:5493004F7TI6QBM4WX72 Impersonation Domains

About This Report: web3pool.lol

Check Any Domain

Report Possibly phishing

Live Threat Feed

Stay Informed, Stay Safe

Recommendations & Advice for Victims

Archive note