oakwherit[.]com[.]wstrustcap[.]com

Analysis of the domain oakwherit.com.wstrustcap.com, first observed on February 21 2026, indicates that it is being used for a brand‑impersonation phishing campaign. The site presented the page title “Oakwdheritage | Official Website,” suggesting an attempt to masquerade as a legitimate heritage‑related service. The domain is registered through GMO Internet Group, Inc. d/b/a Onamae.com and resolves to the IPv4 address 213.165.249.109, which belongs to InMotion Hosting, Inc. (AS22611) located in the Netherlands. No TLS certificate was observed, meaning the site was served over plain HTTP.

The authoritative nameservers are ns1.verification‑hold.suspended‑domain.com and ns2.verification‑hold.suspended‑domain.com, both indicative of a temporary or placeholder configuration often associated with malicious infrastructure. The domain’s trust score from Gridinsoft is 0 / 100, reflecting a complete lack of confidence in its legitimacy. It has been listed on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal analysis shows that two of ninety‑three scanning engines flagged the domain, providing additional confirmation of malicious intent.

As of the report date, the site has been taken offline, and its HTTP status is unavailable. While the available data confirms the phishing intent, details such as the specific brand being spoofed, the exact content of the landing page, and the presence of credential‑capture mechanisms remain unverified. Defenders should continue to monitor the IP address 213.165.249.109 for any re‑hosting activity, enforce blocklists that include this domain, and consider adding the associated nameservers to sink‑hole rules. Organizations that may be targeted should educate users about the lack of HTTPS and the suspicious page title, and encourage reporting of any similar URLs to the appropriate incident‑response teams.