goldfinanceltd[.]com

goldfinanceltd.com was observed on July 12, 2026 as an active generic phishing site targeting users of financial services. The site presents the page title “Goldfinance”, suggesting an attempt to masquerade as a legitimate gold‑investment platform. The domain was registered on February 21, 2026 through Global Domain Group LLC and has been listed on the PhishDestroy blocklist. The domain resolves to the IPv4 address 198.251.83.106, which is advertised as belonging to AS53667 FranTech Solutions in the United States. DNS resolution is served by the authoritative nameservers ns25.asurahosting.com and ns26.asurahosting.com. The site is delivered over HTTPS using a Let’s Encrypt R13 certificate, and the web server reports a LiteSpeed response with HTTP status 200. Technical fingerprinting shows the use of Bootstrap, jsDelivr, cdnjs, Popper, JivoChat, and Cloudflare services, with HTTP/3 enabled. MX records are configured with priority 0 pointing to goldfinanceltd.com, indicating a self‑hosted mail service that could be used for credential harvesting. VirusTotal scanning has flagged the domain by one of ninety‑five security vendors, and the domain appears on a single external blocklist. Current intelligence does not reveal the exact content of the landing pages or the credential‑collection mechanism, leaving the full scope of the campaign uncertain. Defenders should add the domain and its associated IP address to network‑level deny lists, monitor DNS queries for the domain and its nameservers, and block outbound SMTP traffic to the listed MX host. Continuous observation of any changes to the TLS certificate or hosting provider is recommended to detect potential re‑hosting.