goldmares[.]top

This domain, goldmares.top, is flagged as an active investment scam targeting individuals through fraudulent gold-related financial schemes. Registered on March 28, 2026, via Gname.com Pte. Ltd., the domain remains operational as of July 12, 2026, resolving to IP address 172.67.140.120, hosted behind Cloudflare infrastructure in Canada. The site employs Cloudflare nameservers (mike.ns.cloudflare.com, sky.ns.cloudflare.com) and technologies including Vue.js, HSTS, and HTTP/3, which are consistent with modern phishing or scam operations seeking to evade detection and enhance perceived legitimacy. Analysis of the domain's infrastructure reveals a page title of 'Gold,' aligning with the reported scam type (investment scam). The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors leveraging trusted certificate authorities to avoid browser warnings. The domain is currently blocked by three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating prior identification as malicious. Despite these detections, the domain returned an HTTP 200 status during recent scans, confirming its continued activity. No antivirus vendors on VirusTotal currently flag the domain, though this absence does not confirm safety. Defenders should treat goldmares.top as a high-risk domain based on its registration details, infrastructure, and inclusion on multiple blocklists. Network-level blocking or monitoring of connections to 172.67.140.120 is recommended, alongside user education regarding investment scams masquerading as gold trading platforms. Further investigation into the site's content and backend infrastructure is warranted to identify additional indicators of compromise or associated threat actors.