account[.]wealth-net[.]org

The domain account.wealth-net.org was registered through NameCheap on August 15 2022 and is currently hosted on the IP address 198.23.193.170, which belongs to HostPapa (AS36352) in the United States. The authoritative nameservers are dns1.geebytesdns.com and dns2.geebytesdns.com. No TLS certificate is presented for the site, and the HTTP response has been taken offline, indicating that the infrastructure is no longer publicly reachable at the time of analysis. The page title returned when the site was online read "Wealth Net Limited - Trading for everyone," suggesting an attempt to masquerade as a legitimate financial services provider.

The threat actor is classified as a credential phishing operation that impersonates across multiple brands, as indicated by the intelligence field "Impersonates: across." Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly malicious assessment. VirusTotal scans show that six of ninety‑five security vendors flagged the domain, providing additional independent confirmation of malicious intent. The domain has been blocked by the PhishDestroy community and appears on one external security blocklist, demonstrating that at least some defensive feeds have incorporated it.

While the offline status prevents direct observation of the payload or phishing page, the combination of a low trust score, multiple vendor detections, and community blocklisting strongly points to a credential‑theft campaign. Defenders should ensure that account.wealth-net.org is added to URL filtering and DNS blocklists, monitor traffic to the associated IP 198.23.193.170, and enforce TLS inspection to detect any future attempts to serve content over HTTPS. Continuous re‑evaluation of the IP and any related subdomains is advised, as threat actors may reactivate the infrastructure under new configurations.