honest-wealths[.]org

honest-wealths.org is currently active and has been observed delivering generic phishing content aimed at harvesting user credentials. The domain was registered on 14 January 2025 through GO54 LIMITED and is served by the authoritative name servers ns21.v-sys.org and ns22.v-sys.org. DNS resolution points to the IPv4 address 91.235.142.249, which is the sole host associated with the domain in public scans. The hosting infrastructure has not been linked to any known legitimate services and appears to be a disposable or compromised server. Malware and URL analysis on VirusTotal show that two of ninety‑one security vendors have flagged the domain as malicious, indicating that some scanning engines have identified suspicious behavior, while the majority have not raised an alert.

The domain is listed on one external security blocklist and has been actively blocked by the PhishDestroy sink‑hole, confirming that at least one anti‑phishing network is intercepting traffic to it. No TLS certificate details, HTTP status codes, or page title information have been published, so the exact content served by the site remains unverified. Consequently, the precise phishing lure – such as a targeted brand or login portal – cannot be confirmed at this time. However, the combination of recent registration, dedicated name servers, and the presence on a blocklist aligns with the operational patterns of credential‑stealing campaigns.

Defenders should add 91.235.142.249 to network egress filters, enforce DNS blocklists that include honest-wealths.org, and monitor for outbound connections to the associated name servers. Email gateways should be configured to flag any messages containing URLs that resolve to this domain. Continuous re‑scanning on multi‑engine platforms is recommended to detect any changes in the domain’s classification.