ronowealthtrades[.]com

Analysis of ronowealthtrades.com shows a newly registered domain (created March 06, 2026) that resolves to the IPv4 address 66.45.23.50, hosted by OrangeHost LLC under ASN 19853 in the United States. The domain is served via HTTP/3 and does not present an SSL/TLS certificate, indicating that any data transmitted to the site would be unencrypted. DNS resolution is provided by ns1.orangehost.com and ns2.orangehost.com. The site’s page title is "Rono Wealth Trades," but no additional content has been publicly examined, so the exact nature of the impersonated brand or victim‑targeted service remains unclear.

Security telemetry records that the domain is currently taken offline, yet it appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans have flagged the domain in five of ninety‑one AV engines, providing independent confirmation of malicious intent. The combination of a recent registration, lack of TLS, presence on a phishing‑focused blocklist, and multiple vendor detections suggests the domain was used for a generic phishing campaign, likely aiming to harvest credentials or financial information.

Defenders should immediately add the domain to perimeter blocklists, enforce DNS sink‑hole rules for 66.45.23.50, and monitor outbound traffic for HTTP/3 connections to the IP. Intrusion detection signatures should be updated to flag any attempted HTTP requests to the domain, and incident response teams should be alerted to potential phishing emails that reference "Rono Wealth Trades" or similar phrasing. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this host, and any compromised credentials should be rotated promptly.