nepto-wealths[.]com

This domain is flagged for elevated-risk cryptocurrency credential theft activity targeting users through fraudulent investment or wallet access portals. Analysis indicates the infrastructure was designed to harvest login credentials, private keys, or recovery phrases under the guise of a legitimate cryptocurrency wealth management service. The specific threat type involves credential theft with potential secondary payload delivery, such as cryptocurrency drainers or unauthorized transaction scripts. Infrastructure analysis reveals the domain nepto-wealths.com was registered on July 22, 2025, through Ultahost, Inc., and resolved to the IP address 88.222.222.173. The domain appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal. Detected technologies include PHP, amCharts, jQuery, JivoChat, and Hostinger CDN, suggesting a dynamic, interactive phishing interface. The domain was subsequently taken offline, though residual DNS records may persist in caches. Mitigation steps for this threat type include immediate revocation of any credentials entered on the site, particularly cryptocurrency wallet passwords or recovery phrases. Users should enable multi-factor authentication on all financial accounts and monitor transaction histories for unauthorized activity. Network administrators are advised to block the IP 88.222.222.173 and domain nepto-wealths.com at the perimeter. Organizations should update endpoint detection rules to include this domain and its associated indicators, while security teams should review logs for prior connections to the IP or domain to identify compromised systems.