# PhishDestroy domain threat record: goldencapital.click

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/goldencapital.click/
Machine-readable companion: https://phishdestroy.io/domain/goldencapital.click/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-27 23:35:11 UTC
- Stored record updated: 2026-10-28 00:04:10 UTC
- VirusTotal detections in the stored snapshot: 19/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ups

## Stored infrastructure

- Observed IP address: 172.67.220.143
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-06-07 05:43:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019fbc46-ea7e-76fe-a88f-843117b90ec5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/goldencapital.click
- Certificate Transparency search: https://crt.sh/?q=%25.goldencapital.click
- Web Archive lookup: https://web.archive.org/web/*/https://goldencapital.click/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added goldencapital.click to its internal blocklist on 2026-10-28 after a trusted‑auto intake flagged it as suspicious. The recorded page title is “golden capital | a premium AI trading | Official Website”. An HTTP 200 response was observed on 2026-10-28, indicating the site was reachable at that time.

How the scam works
The listing does not confirm a particular fraud technique; however, sites that present themselves as AI‑driven trading platforms are commonly used to entice visitors into providing login credentials, personal data, or funds, or to deliver malicious downloads. No concrete behavior such as credential capture or malware delivery was observed on the captured page.

Evidence
VirusTotal scanned the domain on 2026-10-27 and reported 19 detections from 92 engines, including 16 malicious and 3 suspicious labels (e.g., BitDefender, ESET, Kaspersky). Google Safe Browsing checked the domain on 2026-10-28 and returned no warning. urlscan.io captured a snapshot on 2026-08-01; its engine analysis gave a malicious score of 98 and tagged the URL as malicious, while the overall verdict was non‑malicious. Cloudflare Radar scanned the site on 2026-10-27 and classified it as malicious with a malware tag. OTX listed one pulse referencing the domain on 2026-10-28. PhishDestroy’s internal blocklist marks the domain as blocked, and external blocklist checks on 2026-10-27 found zero hits.

Infrastructure
The domain was registered with Spaceship, Inc. on 2026-06-07 and expires on 2027-06-07. DNS A records resolve to Cloudflare IPs 172.67.220.143 and 104.21.94.72, which belong to Cloudflare, Inc. in Canada. The TLS certificate, issued by Google Trust Services, is valid from 2026-06-08 to 2027-01-02 and uses TLS 1.3 with AES‑128‑GCM. Nameservers are kyrie.ns.cloudflare.com and athena.ns.cloudflare.com.

What to do
Visitors should not submit login credentials, payment information, or download files from this site; if any such data were entered, change the associated passwords and monitor accounts for unauthorized activity. Security teams should block goldencapital.click at the DNS or firewall level, review logs for connections to this hostname, and treat related traffic as potentially malicious.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fbc46-ea7e-76fe-a88f-843117b90ec5/
Cloudflare Radar report: https://radar.cloudflare.com/scan/f864b2a5-f19d-43fc-9c4f-5a8eb2d715fa
Stored capture screenshot: https://urlscan.io/screenshots/019fbc46-ea7e-76fe-a88f-843117b90ec5.png
Cloudflare Radar screenshot (2026-10-27T23:36:12Z): https://screenshots.phishdestroy.io/cf/f864b2a5-f19d-43fc-9c4f-5a8eb2d715fa.png
URLScan screenshot (2026-07-31T15:45:49Z): https://screenshots.phishdestroy.io/us/019fb8da-52b4-744a-9317-f0534b5c8880.png
URLScan capture report: https://urlscan.io/result/019fb8da-52b4-744a-9317-f0534b5c8880/
URLScan screenshot (2026-10-27T23:36:30Z): https://screenshots.phishdestroy.io/us/01a17fb8-ca4a-7499-8d0b-31ace0163279.png
URLScan capture report: https://urlscan.io/result/01a17fb8-ca4a-7499-8d0b-31ace0163279/
VirusTotal report: https://www.virustotal.com/gui/domain/goldencapital.click
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=goldencapital.click
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 23:38:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fbc46-ea7e-76fe-a88f-843117b90ec5.png
  Captured: 2026-10-27 23:35:11 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019fbc46-ea7e-76fe-a88f-843117b90ec5.png
  Source report: https://urlscan.io/result/019fbc46-ea7e-76fe-a88f-843117b90ec5/
- URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fb8da-52b4-744a-9317-f0534b5c8880.png
  Captured: 2026-07-31 15:45:49 UTC
  Source report: https://urlscan.io/result/019fb8da-52b4-744a-9317-f0534b5c8880/
  SHA-256: 5817303c4654272a95d682f1ac8c47a566ed01a0d8850c0593007308109f86ee
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17fb8-ca4a-7499-8d0b-31ace0163279.png
  Captured: 2026-10-27 23:36:30 UTC
  Source report: https://urlscan.io/result/01a17fb8-ca4a-7499-8d0b-31ace0163279/
  SHA-256: 913a4c0c1c832c9699615c96cdc9b75e896d5f7992d1f290a00112026524a56b
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f864b2a5-f19d-43fc-9c4f-5a8eb2d715fa.png
  Captured: 2026-10-27 23:36:12 UTC
  Source report: https://radar.cloudflare.com/scan/f864b2a5-f19d-43fc-9c4f-5a8eb2d715fa
  SHA-256: a129d3c6b5d32fe0d5d30cab6fc459c5fde3313b5306fccd1814fabeffab7af3

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T23:37:36Z",
        "uuid": "019fbc46-ea7e-76fe-a88f-843117b90ec5",
        "scanned_at": "2026-08-01T07:43:18Z",
        "final_url": "https://goldencapital.click/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://goldencapital.click/",
                "from": "http://goldencapital.click/",
                "status": 307
            }
        ],
        "ip": "104.21.94.72",
        "domains": [
            "fonts.googleapis.com",
            "cdnjs.cloudflare.com",
            "fonts.gstatic.com",
            "cdn.jsdelivr.net",
            "static.cloudflareinsights.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "142.250.154.94",
            "104.17.207.5",
            "142.251.14.95",
            "104.17.24.14",
            "104.21.94.72"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "1e0418ad23afd752a633ed985f590cd0085e2c37dbe6dea0490495729867100a",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_nzbth4d",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "goldencapital.click"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "goldencapital.click",
            "protocol": "TLS 1.3",
            "valid_to": "2026-09-06T12:45:09Z",
            "valid_from": "2026-06-08T11:45:18Z"
        },
        "domain_age_days": 54,
        "apex_age_days": 54,
        "tls_age_days": 53,
        "tls_valid_days": 90,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "img-src 'self' data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.c",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T23:37:38Z",
        "uuid": "f864b2a5-f19d-43fc-9c4f-5a8eb2d715fa",
        "scanned_at": "2026-10-27T23:36:12Z",
        "final_url": "https://goldencapital.click/",
        "status": 200,
        "history": [
            {
                "url": "https://goldencapital.click/",
                "status": 200
            }
        ],
        "dom_hash": "7e54b46bbccd97c58262cf19dd744b08487a820055600bd90d03ba47b08d75fd",
        "doc_hash": "22f208bdc7452fda5bcc376c8114ebbc7390b3ab5c2a84aa59bfaa824eb83040",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "goldencapital.click",
                "type": "A",
                "value": "172.67.220.143"
            },
            {
                "name": "goldencapital.click",
                "type": "A",
                "value": "104.21.94.72"
            },
            {
                "name": "goldencapital.click",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:dc8f"
            },
            {
                "name": "goldencapital.click",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:5e48"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.10",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-06-07T07:43:45Z",
            "updated": "2026-06-12T07:44:27Z",
            "expires": "2027-06-07T07:43:45Z",
            "nameservers": [
                "kyrie.ns.cloudflare.com",
                "athena.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T23:35:52Z",
        "analysis_at": "2026-10-27T17:11:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 16,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Bfore.Ai PreCrime": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Spaceship, Inc.",
        "created": "2026-06-07T07:43:45Z",
        "expires": "2027-06-07T07:43:45Z",
        "updated": "2026-06-12T07:44:27Z",
        "first_seen": "2026-06-08T13:15:19Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "athena.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:5e48"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kyrie.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.94.72"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "athena.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.220.143"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:dc8f"
            }
        ],
        "dns_at": "2026-10-27T17:16:54Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "goldencapital.click"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "a049e9a622c1d1b90e39178c3cac369d",
            "sha256": "f256e7b79f5a4c6ebdf881a2fd7d3895e6f93be87815f0bb5b0fe017985d91ff",
            "subject": "goldencapital.click",
            "valid_to": "2027-01-02T01:39:52Z",
            "valid_from": "2026-10-04T00:39:55Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "https://www.spaceship.com/",
            "created": "2026-06-07T07:43:45Z",
            "updated": "2026-06-12T07:44:27Z",
            "expires": "2027-06-07T07:43:45Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "athena.ns.cloudflare.com",
                "kyrie.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-08-21T21:52:54Z",
                "registration": "2026-06-07T07:43:45Z",
                "registrar expiration": "2027-06-07T07:43:45Z",
                "last update of RDAP database": "2026-10-25T04:12:06Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T23:38:00Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "goldencapital.click"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T23:36:48Z",
            "first": "2026-10-27T23:36:48Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 43209
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://goldencapital.click/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "title": "golden capital | a premium AI trading | Official Website",
            "robots": "index, follow",
            "description": "Golden Capital delivers AI-enhanced automation for trade execution workflows, risk governance, and operations tooling built around sophisticated trading bots.",
            "canonicalUrl": "https://goldencapital.click/"
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 6
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 27,
                "wait": 111,
                "connect": 19,
                "download": 35
            },
            "response_ms": 194
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 147789,
            "co2_grams": 0.0054,
            "cleaner_than": 13
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.35.38",
                    "host": "kyrie.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.72",
                    "host": "athena.ns.cloudflare.com"
                }
            ],
            "zone": "goldencapital.click"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3035::6815:5e48",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "goldencapital.click"
        },
        "dns": {
            "A": [
                "172.67.220.143",
                "104.21.94.72"
            ],
            "NS": [
                "kyrie.ns.cloudflare.com",
                "athena.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"athena.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418085392, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3035::6815:5e48",
                "2606:4700:3037::ac43:dc8f"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:;",
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3035::6815:5e48",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://goldencapital.click"
            ]
        },
        "linked_pages": {
            "internal_count": 39
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-06-07T07:43:45Z",
            "updated": "2026-06-12T07:44:27Z",
            "expires": "2027-06-07T07:43:45Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "kyrie.ns.cloudflare.com",
                "athena.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "content-security-policy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.cloudflare.com; default-src 'self'",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```