accounts[.]holtwealthfinance[.]com

The domain accounts.holtwealthfinance.com is a phishing site engaged in brand impersonation, specifically targeting Google users through credential phishing. It presents itself as a legitimate login portal to harvest user credentials but does not deploy a crypto drainer kit. As of the latest verification, accounts.holtwealthfinance.com has been taken offline, though it previously posed an elevated risk to visitors.

Technical analysis reveals that accounts.holtwealthfinance.com was flagged by 3 of 95 VirusTotal security vendors, including Fortinet, Gridinsoft, and Netcraft. It appears on 1 security blocklist (PhishDestroy) and was registered through Atak Domain on March 30, 2025. The domain resolved to the IP address 198.23.141.202, hosted on AS36352 (HostPapa) in the US, with nameservers ns1.sagaciousdns.com and ns2.sagaciousdns.com. No SSL certificate was issued, and the observed page title was 'Welcome to | Holtwealthfinance'. Gridinsoft assigned it a trust score of 0/100, further confirming its malicious nature.

Users who interacted with accounts.holtwealthfinance.com should immediately change any exposed passwords, particularly for Google or other sensitive accounts, and enable two-factor authentication (2FA) where available. Monitor financial and email accounts for unauthorized activity. Report the phishing domain to Google Safe Browsing, the registrar (Atak Domain), and platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.