offshoregoldinvest[.]com

Analysis of offshoregoldinvest.com indicates active malicious infrastructure supporting a generic phishing campaign. The domain was registered on 2024-04-03 through Atak Domain and continues to resolve to the IPv4 address 51.83.96.171. Both authoritative name servers are listed as ns1.internet-source.com and ns2.internet-source.com, which are commonly observed in other abuse cases. The domain appears on a single public blocklist, identified by PhishDestroy, confirming that at least one security organization has taken mitigation action.

VirusTotal scans show that 2 out of 91 security vendors have flagged the domain, providing additional independent corroboration of its malicious nature. No further public intelligence, such as page title, SSL certificate details, or HTTP response codes, has been disclosed at this time, leaving the exact phishing payload and target brand unverified. The combination of a relatively recent registration date, dedicated hosting on a single IP, and multiple vendor detections suggests a purposeful effort to host fraudulent content rather than an incidental misconfiguration. Defenders should block outbound connections to 51.83.96.171 and add offshoregoldinvest.com to local DNS blocklists.

Email security gateways ought to inspect URLs pointing to this domain and quarantine messages that contain it. Continuous monitoring of the associated IP and name servers is recommended, as future campaigns may reuse the same infrastructure. Organizations should also consider sharing any new indicators of compromise with threat‑sharing communities to accelerate collective response.