goldline-invest[.]org

The domain goldline-invest.org was registered on March 11 2026 through Ultahost, Inc. and resolves to the IPv4 address 193.23.118.42, which is advertised by AS214036 (Ultahost, Inc.) and geolocated to the Netherlands. The site is reachable over HTTPS using a Let’s Encrypt certificate (issuer YE2) and returns HTTP status code 200. The page title advertises a “Trusted Investment and Crypto Mining Company”, aligning with the observed investment‑type phishing classification. The domain is currently listed as active and assigned a high risk rating. Infrastructure analysis shows the domain is hosted on a LiteSpeed web server and utilizes a stack that includes Bootstrap, jQuery, particles.js, OWL Carousel, and third‑party widgets such as WidgetWhats and Smartsupp. Google Hosted Libraries are also referenced, indicating reliance on external CDN resources. The site’s DNS resolution is provided by ns1.mywebvps2.com and ns2.mywebvps2.com. Reputation services report a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist (PhishDestroy). VirusTotal records two detections out of ninety‑five scanners, confirming that at least a subset of security products have flagged the site as malicious. Defenders should treat goldline-invest.org as a confirmed phishing infrastructure targeting users with investment‑related lures. Immediate actions include adding the domain and its resolving IP address 193.23.118.42 to web‑filter blocklists, configuring DNS sink‑hole rules for the associated nameservers, and monitoring outbound connections to the identified CDN and widget services for potential data exfiltration. Because the site employs a valid TLS certificate, inspection of encrypted traffic may be required to detect credential harvesting attempts. Continuous re‑evaluation is advised, as the threat actor could modify hosting or certificate details while maintaining the same domain registration.