wealthcoinfx[.]net

This investigation documents the domain wealthcoinfx.net, which was created on 3 March 2026 and is currently taken offline. The domain resolves to the IPv4 address 172.93.120.110, an address allocated to AS393960 Host4Geeks LLC in the United States. Registration details list HOSTINGER operations, UAB as the registrar, and the authoritative nameservers are ns1.spantrix.com and ns2.spantrix.com. No TLS certificate was observed for the host, indicating that HTTPS was not offered at the time of analysis.

VirusTotal scanned the domain and recorded four positive detections out of ninety‑four submitted security vendors, confirming that multiple independent scanners identify the site as malicious. Google Safe Browsing classifies the URL as a social engineering threat, and the domain appears on three external security blocklists. Additional community blocklists from PhishDestroy, MetaMask, and SEAL have also listed wealthcoinfx.net, reinforcing its reputation as a phishing vector. The page title returned by the server is “WealthcoinFX.net”, but the content of the landing page has not been captured, so the specific phishing lure or credential‑harvesting technique remains unverified.

The lack of an SSL certificate further suggests that the operators relied on unencrypted HTTP connections, a common characteristic of low‑cost phishing deployments. Given the observed infrastructure, defenders should immediately add 172.93.120.110 to network‑level deny lists and enforce DNS‑based blocking for wealthcoinfx.net. Continuous monitoring of the associated nameservers (ns1.spantrix.com, ns2.spantrix.com) and the registrar (HOSTINGER operations, UAB) is advised, as future campaigns may reuse the same registration profile. Threat‑intel feeds that reference the four VirusTotal detections, the Google Safe Browsing flag, and the three blocklist entries should be updated to reflect the current offline status while retaining the indicator for potential re‑use.