wealthy[.]to

Analysis indicates that the domain wealthy.to was registered on April 4 2026 via Namecheap and is currently active. The site serves over HTTPS using a Let's Encrypt R12 certificate, and resolves to IP 216.198.79.1, which is geolocated to the United States and associated with Lefkoff Industries. The HTTP response code is 200 and the page title returned is "WealthY Platform", matching the indicated investment scam type. The domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that three out of ninety‑four AV engines flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and the risk rating is high. The infrastructure uses the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com, which are typical for newly created domains. No additional infrastructure such as CDN or anomalous ASN information is observed. The evidence confirms that wealthy.to is being used for an investment‑focused phishing campaign. Uncertainty remains regarding the exact payload, credential‑harvesting mechanisms, and any downstream command‑and‑control infrastructure, as no page content analysis is available. Defenders should block the domain at the network perimeter, update DNS filtering policies, and add it to internal threat‑intel feeds. Continuous monitoring of the IP address and associated hostnames is advised, and any traffic to the site should be logged for forensic review. Incident response teams should be prepared to investigate any compromised credentials that may be linked to the WealthY Platform naming.