wise[.]mantrid[.]net

wise.mantrid.net was observed on 2026-07-12 as a high‑risk generic phishing infrastructure. The domain was registered on 2026-03-31 through Synergy Wholesale Accreditations Pty Ltd and is currently active. Its creation date and registration details place the domain within a short operational window, suggesting a recent deployment aimed at exploiting timely trends.

The authoritative name servers are ns1.hosting-cloud.net, ns2.hosting-cloud.net, ns3.hosting-cloud.net, and ns4.hosting-cloud.net, all pointing to the single IPv4 address 103.119.110.199. Geolocation data ties the IP to Australia, specifically an entity identified as Alt I Services. The web service presents an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (R12). The page title returned is “Wise: Online Money Transfers | International Banking Features”, indicating an attempt to imitate a legitimate financial service.

Reputation checks show a Gridinsoft trust score of 0 / 100 and a single inclusion on a security blocklist. The domain is listed on PhishDestroy and appears on one additional blocklist. VirusTotal scans report 1 positive detection out of 95 security vendors, reinforcing the suspicion of malicious intent. No further content analysis is available beyond the page title; the exact phishing landing page, credential‑capture mechanisms, or payload delivery have not been publicly disclosed.

Defenders should add 103.119.110.199 and the full set of ns*.hosting-cloud.net records to deny‑list rules, and enforce DNS filtering for wise.mantrid.net. Continuous monitoring of the certificate renewal cycle and blocklist status is advised, as the infrastructure may be repurposed after certificate expiration. Network traffic to the associated IP should be logged and inspected for credential‑stealing activity, and users should be warned about unsolicited communications referencing “Wise” financial services.