# PhishDestroy domain threat record: goldensotka.com.ua

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/goldensotka.com.ua/
Machine-readable companion: https://phishdestroy.io/domain/goldensotka.com.ua/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 23:39:36 UTC
- Last availability or vendor check: 2026-10-22 10:28:50 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.31.155
- Registrar in stored WHOIS data: ПП "Український хостінг"
- Last stored HTTP status: 200
- Registration date (registry RDAP, goldensotka.com.ua): 2023-06-03 08:25:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1282d-b65a-736b-adf5-31f624bedfee/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/goldensotka.com.ua
- Certificate Transparency search: https://crt.sh/?q=%25.goldensotka.com.ua
- Web Archive lookup: https://web.archive.org/web/*/https://goldensotka.com.ua/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
goldensotka.com.ua is classified by PhishDestroy as an impersonation phishing page. Its title presents it as the author's blog of a company called GoldenSotka, covering renovation, interior design and construction, which suggests it targets Ukrainian-speaking visitors. PhishDestroy first saw the domain on 2026-10-11. On 2026-10-19 the domain still responded, but its page content could not be loaded.

How the scam works
An impersonation page borrows the name and look of a business or service so that visitors treat it as legitimate and act on what it asks. These pages typically push people toward a form, login prompt or contact request that collects credentials, personal details or payment information for the operators. The page title here describes an ordinary renovation and interior-design blog, while our classification is impersonation phishing.

Evidence
On 2026-10-12, 11 of 92 VirusTotal engines flagged the domain. Named detections include alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. That is a minority of engines, but the flags come from several unrelated vendors, so the verdict does not rest on a single source. The domain also appears in 35 AlienVault OTX pulses, meaning other researchers have independently linked it to threat activity. PhishDestroy lists it on its blocklist.

Infrastructure
The domain was registered on 2023-06-03, more than three years before PhishDestroy detected it. An older domain carries a history that newly registered phishing domains lack, and that history can help it slip past filters keyed to domain age. It is registered through ПП "Український хостінг" and sits behind Cloudflare (AS13335) in the US. Cloudflare's proxy hides the server that actually hosts the content.

What to do
If you submitted a password on this site, change it immediately along with any account that reuses it, and turn on two-factor authentication. If you shared phone numbers, ID details or card data, watch for follow-up calls or messages that quote that information back to you. Contact your bank if you made a payment. Security teams should block the domain at DNS and proxy level and check logs for visits or form submissions. They can also report it to Cloudflare and the registrar to support takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1282d-b65a-736b-adf5-31f624bedfee/
VirusTotal report: https://www.virustotal.com/gui/domain/goldensotka.com.ua
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=goldensotka.com.ua
Archived copy: https://web.archive.org/web/20261010234041/https://goldensotka.com.ua/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:03 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1282d-b65a-736b-adf5-31f624bedfee.png
  Captured: 2026-10-10 23:39:36 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1282d-b65a-736b-adf5-31f624bedfee.png
  Captured: 2026-10-10 23:39:36 UTC
  Source report: https://urlscan.io/result/01a1282d-b65a-736b-adf5-31f624bedfee/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/149d1d35-f871-48a1-9d66-30fa42d8266c.png
  Captured: 2026-10-12 11:12:49 UTC
  Source report: https://radar.cloudflare.com/scan/149d1d35-f871-48a1-9d66-30fa42d8266c
  SHA-256: fc28264d2614c34f141a0acf838be0b943e0fd74a80c6f830cc1dde2251d90a9
- URLQuery: https://screenshots.phishdestroy.io/uq/a15a3708-d6ca-4cec-903b-6a2858b0f2ef.png
  Source report: https://urlquery.net/report/a15a3708-d6ca-4cec-903b-6a2858b0f2ef
  SHA-256: 67d51f90ffc4c2875b14368ff53dff9576e60c5c64c8b44fd9df97c6dcef0779
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12821-d288-759b-a1c8-4bd8103f4bcb.png
  Captured: 2026-10-10 23:24:40 UTC
  Source report: https://urlscan.io/result/01a12821-d288-759b-a1c8-4bd8103f4bcb/
  SHA-256: 5037da8deb61ac09749451f47b039e8889b18f3c3916116a7f08b6c1dcfe2d1b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:32:58Z",
        "uuid": "01a1282d-b65a-736b-adf5-31f624bedfee",
        "scanned_at": "2026-10-10T23:37:33Z",
        "final_url": "https://goldensotka.com.ua/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://goldensotka.com.ua/",
                "from": "http://goldensotka.com.ua/",
                "status": 307
            }
        ],
        "ip": "172.67.178.58",
        "domains": [
            "cdn.zopim.com",
            "widget-mediator.zopim.com",
            "v2.zopim.com",
            "ekr.zdassets.com",
            "static.zdassets.com",
            "www.google.com",
            "dtmvdvtzf8rz0.cloudfront.net"
        ],
        "ips": [
            "216.198.54.3",
            "216.198.53.3",
            "104.17.96.195",
            "142.251.153.119",
            "172.67.178.58"
        ],
        "asns": [
            "209242",
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.ecoclimate.biz",
            "oknavik.dp.ua",
            "seotop.com.ua",
            "xatakryta.com",
            "tech-profit.com.ua",
            "farm-market.kiev.ua",
            "transfercomfort.com.ua",
            "agromag.ua",
            "my-protein.kiev.ua",
            "steklo-armatura.com"
        ],
        "doc_hash": "8d53498f9743e9099dee7d44de06975962ff2200bffb18c2f5810d50a0730230",
        "script_hashes": [
            "e19859c52994046cc89a4fd13bf8b2a65a3c871271bae9faf341adde43e2453c",
            "f969671cdbae0007370b6e1fdfe99a24da6b5c90fdbbc68499b79d6e2b6c306e",
            "4f6a9c99d36c51fabdd3e290c6a7fafb8252e6f34627d37d133ee9381a7880e5",
            "4324df269ff5984283daa0d5b8388887f50cc2e875d7b739e4946443fef18903",
            "7bf16e6815c6cf8489dc1b62a2783b5038edbd66e968ec974b2131d36914db82",
            "bffddb6b555086fa4f29745cb8f7ce01e40356e11c1bed849b33c4a64402ea73"
        ],
        "globals": [
            "jQuery",
            "$zopim",
            "_wpcf7",
            "pollsL10n",
            "zEWebpackACJsonp",
            "zE",
            "zEmbed",
            "zEACLoaded",
            "__$z_results",
            "__$z_innerText"
        ],
        "cookies": [
            "AWSALBCORS"
        ],
        "storage_keys": [
            "__storejs__"
        ],
        "tls": {
            "san": [
                "goldensotka.com.ua",
                "*.goldensotka.com.ua"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "goldensotka.com.ua",
            "protocol": "QUIC",
            "valid_to": "2026-11-28T17:00:10Z",
            "valid_from": "2026-08-30T16:02:48Z"
        },
        "domain_age_days": 2788,
        "apex_age_days": 2788,
        "tls_age_days": 41,
        "tls_valid_days": 90,
        "requests": 37,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 86,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/7.2.34"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:44:20Z",
        "uuid": "149d1d35-f871-48a1-9d66-30fa42d8266c",
        "scanned_at": "2026-10-12T11:12:49Z",
        "final_url": "https://goldensotka.com.ua/",
        "status": 200,
        "history": [
            {
                "url": "https://goldensotka.com.ua/",
                "status": 200
            }
        ],
        "dom_hash": "250af05a86dea0a86d9cb2fe9e968abd7c0647f794c229215dd266cfa482b39d",
        "doc_hash": "eefa6058b330a9ba59df453045059c586ac886a28346fe92267ddc91f5dafcb8",
        "domain_risks": [
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "goldensotka.com.ua",
                "type": "A",
                "value": "172.67.178.58"
            },
            {
                "name": "goldensotka.com.ua",
                "type": "A",
                "value": "104.21.31.155"
            },
            {
                "name": "goldensotka.com.ua",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1f9b"
            },
            {
                "name": "goldensotka.com.ua",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:b23a"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.178.58",
        "whois": {
            "registrar": "ua.hosting",
            "created": "2023-06-03T08:25:07Z",
            "updated": "2026-06-02T08:10:06Z",
            "expires": "2027-06-03T08:25:07Z",
            "nameservers": [
                "carlos.ns.cloudflare.com",
                "gigi.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:37:54Z",
        "analysis_at": "2026-10-13T02:17:11Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 11,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "G-Data": "phishing",
            "Lionic": "malicious",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "malware",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Malicious (alphaMountain.ai)"
        },
        "registrar": "ua.hosting",
        "expires": "2027-06-03T08:25:07Z",
        "first_seen": "2023-10-05T13:01:02Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "carlos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1f9b"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "carlos.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:b23a"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "gigi.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.178.58"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "mx.ukrdomen.com",
                "priority": 5
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.31.155"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 a mx ip4:93.190.40.253 ip4:93.190.40.15 ip4:93.190.40.17 ip4:93.190.40.20 ~all"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "mx2.uh.com.ua",
                "priority": 10
            }
        ],
        "dns_at": "2026-10-13T02:22:28Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "goldensotka.com.ua",
                "*.goldensotka.com.ua"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "b6b30936451a4224132f82c938507e59",
            "sha256": "ec7361ca91fe5483d767c4210221f8cbce042a732f00abf37dd471428ac96cc3",
            "subject": "goldensotka.com.ua",
            "valid_to": "2026-11-28T17:00:10Z",
            "valid_from": "2026-08-30T16:02:48Z"
        },
        "whois": {
            "registrar": "ua.hosting"
        }
    }
}
```