wealthnestsavings[.]com

The domain wealthnestsavings.com is currently active and returns HTTP 200 with a valid Let's Encrypt (R12) certificate. DNS resolution points to 163.61.188.7, an IP registered in the United States and associated with MIT‑listed infrastructure. The zone is served by four LyteHosting nameservers (dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, dns4.lytehosting.com) and the registrar is Web Commerce Communications Limited dba WebNic.cc. The MX record is self‑referential (priority 0, host wealthnestsavings.com), a pattern often seen in phishing deployments. Threat intelligence indicates the domain appears on one public blocklist and is explicitly blocked by PhishDestroy. VirusTotal scans have recorded four detections out of ninety‑one scanners, and AlienVault OTX includes the indicator in two separate pulses. The observed page title is "Wealthnest Savings", but no deeper content analysis is available. Considering active hosting, valid TLS, self‑hosted mail, multiple vendor detections, and inclusion on phishing‑focused blocklists, the domain should be treated as high‑risk. Defenders are advised to block the domain at perimeter and DNS layers, monitor outbound connections to 163.61.188.7, and add the indicator to threat‑intel feeds. Ongoing observation is recommended to detect any future credential‑collection pages or additional malicious activity.