auto-wealth[.]org

This domain, auto-wealth.org, is flagged as a generic phishing site targeting users with a fraudulent investment platform branded as 'Auto Wealth.' Analysis indicates no direct association with known legitimate financial services, suggesting a standalone credential-harvesting or fraudulent investment scheme. The infrastructure does not align with documented drainer kits, but the use of WordPress and associated technologies may facilitate dynamic content delivery for phishing campaigns. Infrastructure analysis reveals the domain resolves to IP address 163.61.188.7 and was registered on December 10, 2024, through GO54 LIMITED. VirusTotal reports 4 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The site employs a Let's Encrypt SSL certificate, PHP, MySQL, LiteSpeed, and front-end libraries such as jQuery and Slick, which are commonly exploited to enhance phishing page functionality. As of the latest verification, auto-wealth.org remains active, posing an ongoing risk to users. Response actions should include immediate blocking of the domain and IP at the network level, alongside monitoring for related infrastructure. The low detection rate (4/95) and recent registration suggest the campaign may still be in early deployment, increasing the likelihood of undetected variants. Users are advised to verify investment platforms through official channels and avoid entering credentials on unverified sites.