wealthspringinc[.]org

Analysis of wealthspringinc.org indicates a high-risk phishing domain targeting financial services. The domain was registered on August 28, 2025, through NAMECHEAP INC, a registrar frequently used by threat actors for disposable infrastructure. It currently resolves to IP address 199.188.200.69 and uses nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com, consistent with Namecheap’s hosting environment. As of July 27, 2026, the domain remains active and has been blocked by PhishDestroy, appearing on at least one security blocklist.

VirusTotal scans show that 2 of 91 security vendors flag this domain as malicious, though the specific detection reasons are not disclosed in available intelligence. No page title, brand target, or phishing kit details are currently confirmed, so the exact content and targeted brand remain unanalyzed. However, the domain name—containing 'wealth' and 'spring'—suggests a likely focus on investment or financial fraud, a common tactic in phishing operations. Defenders should treat this domain as an active threat.

The combination of recent registration, use of a high-volume registrar, detection by multiple security vendors, and presence on blocklists provides sufficient evidence for immediate blocking at the network level. Organizations are advised to monitor for connections to 199.188.200.69 and the associated nameservers, as these may indicate compromised endpoints attempting to communicate with the phishing infrastructure. No SSL certificate details or HTTP response data are currently available, so additional analysis of the site’s behavior is recommended if further visibility is required.