assettwealth[.]com

The domain assettwealth.com is currently active and classified as a high‑risk brand‑impersonation operation targeting Google. The site is listed as a tech‑support scam, where attackers typically claim to provide unsolicited support for Google services. The page title returned by the server is simply “assettwealth.com”, offering no further context. Infrastructure analysis shows the domain was registered on 22 September 2025 through Sav.com, LLC. DNS resolution points to the IPv4 address 198.12.80.250, which belongs to AS36352 (HostPapa) and is geolocated in the United States. Authoritative nameservers are dns1.safedatahost.cloud and dns2.safedatahost.cloud. The site presents a valid TLS certificate issued by Let’s Encrypt (R12), indicating encryption is in place, and the web server reports an HTTP 200 status. Reputation data underline the malicious nature of the infrastructure. The domain appears on a single public security blocklist and is blocked by PhishDestroy. VirusTotal scans have flagged the domain by 13 out of 95 security vendors. Independent scoring services assign extremely low trust values: Gridinsoft scores 0 / 100 and Scamadviser 1 / 100. Detected web technologies include YouTube embeds, Bootstrap, LiteSpeed, Smartsupp, jQuery UI, jQuery, GetButton, and FancyBox, a combination often observed in credential‑harvesting kits. Defenders should prioritize immediate containment of assettwealth.com. Network‑level rules to deny outbound or inbound traffic to 198.12.80.250, as well as DNS filtering of the domain and its authoritative name servers, will reduce exposure. Continuous monitoring of related host‑header patterns and the identified technology stack can help surface derivative payloads. Organizations should also update user‑awareness materials to reference the Google‑impersonation theme and the tech‑support lure used by this campaign.