wealthspheres[.]org

This domain, wealthspheres.org, is identified as a fraudulent crypto investment scam specifically designed to impersonate Wealthspheres, a legitimate financial platform. Analysis indicates the site operated as a phishing framework targeting users with promises of secure cryptocurrency investments. The domain is currently offline, though prior activity suggests it was actively used to harvest credentials and facilitate unauthorized fund transfers. Infrastructure analysis reveals the domain was registered on October 01, 2025, through Global Domain Group LLC and resolved to the IP address 198.251.88.6. It was flagged by 6 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 7/100 and a Scamadviser trust score of 1/100. The domain appears on three distinct security blocklists and was proactively blocked by multiple threat intelligence platforms. The SSL certificate was issued by Let’s Encrypt, a common tactic among phishing domains to mimic legitimacy. Detected technologies include Bootstrap, LiteSpeed, jQuery, Google Analytics, and Cloudflare Browser Insights, indicating a well-structured but malicious web presence. The domain’s current offline status does not eliminate residual risk, as associated infrastructure may persist or resurface under a different name. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. Users who interacted with the site should assume credential compromise and initiate password resets for all linked accounts, particularly cryptocurrency wallets and financial services. Monitoring for unauthorized transactions is critical, and any suspicious activity should be reported to relevant financial institutions and cybersecurity authorities.