# PhishDestroy domain threat record: officialgoldexchange.ltd Content language: English Canonical HTML report: https://phishdestroy.io/domain/officialgoldexchange.ltd/ Machine-readable companion: https://phishdestroy.io/domain/officialgoldexchange.ltd/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 20:06:25 UTC - Last availability or vendor check: 2026-10-28 00:31:34 UTC - Stored record updated: 2026-10-28 00:31:34 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: revolut ## Stored infrastructure - Observed IP address: 198.251.89.82 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-10 08:09:10 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17f06-4b5c-752f-97f1-dc45d760a202/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/officialgoldexchange.ltd - Certificate Transparency search: https://crt.sh/?q=%25.officialgoldexchange.ltd - Web Archive lookup: https://web.archive.org/web/*/https://officialgoldexchange.ltd/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified officialgoldexchange.ltd as malicious because the page claims to be a regulated broker offering a “Starter Plan” with 2 % daily returns for seven days and references “WALL STREET TRADERS” and “NYSE” without verifiable links, a pattern typical of fraudulent investment schemes. The domain was first observed by PhishDestroy on 2026-10-27, and the recorded page returned HTTP 200 with the title “OFFICIAL GOLD EXCHANGE- Main”. How the scam works Fake‑investment broker scams lure victims by presenting themselves as licensed financial services that guarantee high, short‑term yields. Victims are asked to deposit funds upfront, after which the operators disappear or provide fabricated statements to extract additional payments. No legitimate trading activity occurs and the promised returns are never delivered. Evidence VirusTotal scanned the domain on 2026-10-26 and reported two malicious detections out of 92 engines, specifically from Bfore.Ai PreCrime and Netcraft. Google Safe Browsing checked the URL on 2026-10-27 and did not flag it. urlscan.io captured the site on 2026-09-24; its machine‑learning engines assigned a malicious score of 88 while the overall verdict was clean. Cloudflare Radar on 2026-10-27 labeled the URL as phishing and assigned the domain risk “Scam”. PhishDestroy’s internal blocklist includes the domain; external blocklists returned zero hits, and OTX reported no pulses. Infrastructure The domain was registered on 2026-09-10 through Dynadot Inc, 47 days before first observation. At the time of the scans it resolved to IP 198.251.89.82, which was listed in the FranTech Solutions network in Luxembourg. The TLS certificate observed was issued by Let’s Encrypt, valid from 2026-09-12 to 2026-12-11, and the authoritative nameservers were ns115.my-control-panel.com and ns116.my-control-panel.com. What to do Do not provide any personal, financial, or login information to this site; if credentials were entered, change the associated passwords immediately. Defenders should block officialgoldexchange.ltd in web and email filters, monitor outbound traffic for connections to the recorded IP, and review logs for any access attempts. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0d43c-2ee4-71ee-8bb9-bd4498f0ddef/ Cloudflare Radar report: https://radar.cloudflare.com/scan/d0d4bda1-a501-4510-9b24-a19b1445a46d Stored capture screenshot: https://urlscan.io/screenshots/01a0d43c-2ee4-71ee-8bb9-bd4498f0ddef.png Cloudflare Radar screenshot (2026-10-27T20:11:07Z): https://screenshots.phishdestroy.io/cf/d0d4bda1-a501-4510-9b24-a19b1445a46d.png VirusTotal report: https://www.virustotal.com/gui/domain/officialgoldexchange.ltd Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=officialgoldexchange.ltd Archived copy: https://web.archive.org/web/20261027200713/https://officialgoldexchange.ltd/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 20:13:18 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a17f06-4b5c-752f-97f1-dc45d760a202.png Captured: 2026-10-27 20:23:23 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17f06-4b5c-752f-97f1-dc45d760a202.png Captured: 2026-10-27 20:23:23 UTC Source report: https://urlscan.io/result/01a17f06-4b5c-752f-97f1-dc45d760a202/ - URLScan capture 2: https://urlscan.io/screenshots/01a0d43c-2ee4-71ee-8bb9-bd4498f0ddef.png Captured: 2026-10-27 20:06:25 UTC Source report: https://urlscan.io/result/01a17f06-4b5c-752f-97f1-dc45d760a202/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d0d4bda1-a501-4510-9b24-a19b1445a46d.png Captured: 2026-10-27 20:11:07 UTC Source report: https://radar.cloudflare.com/scan/d0d4bda1-a501-4510-9b24-a19b1445a46d SHA-256: 7f9701aa069530667a181f9ece366c4186384165893654092e67eb0231b5dfea - URLQuery: https://screenshots.phishdestroy.io/uq/e0107ce0-bc36-4bcf-98e9-9c236aa9dcea.png Source report: https://urlquery.net/report/e0107ce0-bc36-4bcf-98e9-9c236aa9dcea SHA-256: 97452763e105397c63637c7a0159b310af134adfc1e8d6b0a360ebf283691f22 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T20:30:41Z", "uuid": "01a17f06-4b5c-752f-97f1-dc45d760a202", "scanned_at": "2026-10-27T20:21:41Z", "final_url": "http://officialgoldexchange.ltd/", "status": 200, "redirects": [ { "to": "https://officialgoldexchange.ltd/", "from": "http://officialgoldexchange.ltd/", "status": 307 }, { "to": "http://officialgoldexchange.ltd/", "from": "https://officialgoldexchange.ltd/", "status": 307 } ], "ip": "198.251.89.82", "ptr": "d8.my-control-panel.com", "domains": [ "www.tradingview-widget.com", "widgets.tradingview-widget.com", "s3-symbol-logo.tradingview.com", "www.youtube.com", "widget-v3.smartsuppcdn.com", "widgetdata.tradingview.com", "widget-sheriff.tradingview-widget.com", "www.gstatic.com", "s3.tradingview.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "fonts.gstatic.com", "websocket-visitors.smartsupp.com", "translate-pa.googleapis.com", "bootstrap.smartsuppchat.com", "i.ytimg.com", "www.google.com", "static.doubleclick.net", "images.unsplash.com", "www.smartsuppchat.com", "translate.googleapis.com", "translate.google.com", "fonts.googleapis.com" ], "ips": [ "178.249.213.2", "172.217.115.4", "63.180.149.57", "172.217.118.4", "142.250.195.118", "18.67.93.89", "142.251.151.119", "142.250.195.102", "142.250.183.34", "142.251.42.99", "3.175.115.32", "151.101.2.208", "95.173.204.21", "142.251.151.4", "142.251.222.234" ], "asns": [ "60068", "15169", "16509", "54113", "200325", "53667" ], "countries": [ "JP", "US", "DE", "AU", "LU" ], "link_domains": [ "translate.google.com", "www.tradingview.com" ], "doc_hash": "1c103a0efc25f2d1358337e7123f3d7d7b41f6c8dd02e26a0c9dc08f7f25f9a7", "script_hashes": [ "2dac47cb7069588de91e3bfb26fbb1153ad8b837094a02e29d98076bb09c72de", "f581de2651bcaf5ce78f0871423cbbaeb957eec2f32051c20928ec9b1920beb1", "1717ea1fde8ceb7584341a24efc85c853083c660a1185968fbf94520f7193de2", "c25f8e15bf2a21c024f0ffd9894681eccf39bb93892fa35f4c5b4c48fa8c5bb9", "160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef", "99271224a929a6b7d4f064b6e3276774fb40b37aafc2961942f763815acef6c3", "1f7723b6b9bfced0deba108df48e3287888dd986f1ff2d5133bacc9807ac0349", "71c0e1711f9a714147696aa3da0bbadbbc1c39c3b129718d6f75f3efd08f2b14", "23e036f368c0e07eb489c2af77c421aa57f1861e83558c2ccc48e9bcc8ff5c53", "7d3b9482d4fb3b6aeaa089b08eb84381b5d3294c32c71ba320c4482bb4dbb8d5" ], "globals": [ "html5", "Modernizr", "$", "jQuery", "googleTranslateElementInit", "_DumpException", "google", "_smartsupp", "smartsupp", "default_tr", "_F_toggles_default_tr", "styleSwitcher", "Popper", "bootstrap", "SMARTSUPP_LOADED", "$smartsupp", "scrollAndFocus", "c", "fontSpy", "jQueryBridget", "EvEmitter", "getSize", "matchesSelector", "fizzyUIUtils", "Outlayer", "Isotope", "Masonry", "Packery", "Vivus", "theme", "punchgs", "_gsScope", "RsTypewriterAddOn", "initialized", "colors", "listCountries", "listPlans", "transarray", "run", "request" ], "cookies": [ "PHPSESSID", "__Secure-YNID", "YSC", "__Secure-ROLLOUT_TOKEN", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA" ], "domain_age_days": 46, "apex_age_days": 46, "requests": 193, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T20:12:30Z", "uuid": "d0d4bda1-a501-4510-9b24-a19b1445a46d", "scanned_at": "2026-10-27T20:11:07Z", "final_url": "https://officialgoldexchange.ltd/", "status": 200, "history": [ { "url": "https://officialgoldexchange.ltd/", "status": 200 } ], "dom_hash": "bb09602acdcea5adc09b630f9c31bda73f5c6aa19bd91ca5e53cd0db80e9f67d", "doc_hash": "1c103a0efc25f2d1358337e7123f3d7d7b41f6c8dd02e26a0c9dc08f7f25f9a7", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "domain_risks": [ "Scam", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "officialgoldexchange.ltd", "type": "A", "value": "198.251.89.82" } ], "dnssec_valid": false, "ip": "127.0.1.43", "whois": { "registrar": "Dynadot Inc", "created": "2026-09-10T10:09:10Z", "updated": "2026-09-15T10:09:40Z", "expires": "2027-09-10T10:09:10Z", "nameservers": [ "ns115.my-control-panel.com", "ns116.my-control-panel.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T20:10:05Z", "analysis_at": "2026-10-26T02:15:09Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 2, "suspicious": 0, "undetected": 37 }, "detections": { "Netcraft": "malicious", "Bfore.Ai PreCrime": "malicious" }, "reputation": 0, "first_seen": "2026-09-11T07:17:19Z", "dns": [ { "ttl": 3600, "type": "NS", "value": "ns116.my-control-panel.com" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 a mx ip4:198.251.89.82 ip4:198.251.89.82 ~all" }, { "ttl": 3600, "type": "NS", "value": "ns115.my-control-panel.com" }, { "ttl": 3600, "type": "MX", "value": "mail.officialgoldexchange.ltd", "priority": 10 }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.officialgoldexchange.ltd", "value": "ns115.my-control-panel.com" }, { "ttl": 3600, "type": "A", "value": "198.251.89.82" } ], "dns_at": "2026-10-26T02:21:07Z", "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a", "cert": { "san": [ "*.officialgoldexchange.ltd", "officialgoldexchange.ltd" ], "issuer": "Let's Encrypt / YE1", "serial": "539af83db310d5dd569ed5dc2d20d292e3a", "sha256": "f2195dc564b6d13f97e8229552f9d2f8ada269ca2abc02fc0a1365b6a3043465", "subject": "officialgoldexchange.ltd", "valid_to": "2026-12-11T00:16:21Z", "valid_from": "2026-09-12T00:16:22Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-10T10:09:10Z", "last changed": "2026-09-11T16:43:14Z", "registration": "2026-09-10T10:09:10Z", "registrar expiration": "2027-09-10T10:09:10Z", "last update of RDAP database": "2026-10-23T11:12:54Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T20:12:55Z", "mail_config": { "mx": [ "mail.officialgoldexchange.ltd" ], "spf": "v=spf1 a mx ip4:198.251.89.82 ip4:198.251.89.82 ~all", "spf_lookups": 2 }, "caa_records": { "domain": "officialgoldexchange.ltd" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-27T20:07:13Z", "first": "2026-10-27T20:07:13Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 26135 }, "security_txt": { "present": true, "found_in": "/.well-known/security.txt" }, "social_tags": { "title": "OFFICIAL GOLD EXCHANGE- Main", "author": "Swift", "keywords": "swift template", "themeColor": "#ffffff", "description": "We’re a top provider of CFDs and mirror trading operations,We give investors leveraged access to over 15 financial markets through our award-winning portal" }, "mixed_content": { "no_sri": [ "https://translate.google.com/translate_a/element.js", "https://s3.tradingview.com/external-embedding/embed-widget-tickers.js", "https://s3.tradingview.com/external-embedding/embed-widget-single-quote.js", "https://s3.tradingview.com/external-embedding/embed-widget-financials.js" ], "third_party_scripts": 4 }, "status": { "up": true, "code": 200, "timings": { "dns": 98, "tls": 77, "wait": 2434, "connect": 61, "download": 185 }, "response_ms": 2855 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 105724, "co2_grams": 0.0039, "cleaner_than": 21 }, "dns_server": { "ns": [ { "ip": "23.153.104.136", "host": "ns115.my-control-panel.com" }, { "ip": "23.153.104.137", "host": "ns116.my-control-panel.com" } ], "zone": "officialgoldexchange.ltd" }, "location": { "ip": "198.251.89.82", "asn": "53667", "org": "FranTech Solutions", "city": "Luxembourg", "country": "LU" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "officialgoldexchange.ltd" }, "dns": { "A": [ "198.251.89.82" ], "MX": [ "{\"exchange\": \"mail.officialgoldexchange.ltd\", \"priority\": 10}" ], "NS": [ "ns115.my-control-panel.com", "ns116.my-control-panel.com" ], "SOA": "{\"nsname\": \"ns115.my-control-panel.com\", \"hostmaster\": \"hostmaster.officialgoldexchange.ltd\", \"serial\": 2026091205, \"refresh\": 3600, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 1800}", "TXT": [ "v=spf1 a mx ip4:198.251.89.82 ip4:198.251.89.82 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "198.251.89.82", "family": 4 }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html", "x-frame-options": "SAMEORIGIN" } } } } ```