goldrepublicvault[.]com

PhishDestroy has identified goldrepublicvault.com as a confirmed brand impersonation scam, specifically targeting customers of GoldRepublic, a legitimate precious metals investment platform. The domain is currently offline, having been taken down after its malicious nature was exposed. This site was designed to deceive visitors into believing they were accessing the official GoldRepublic vault platform, likely to harvest login credentials or financial information.

Technical analysis reveals that the domain was created on April 11, 2026, a recent date consistent with phishing operations. It was registered through TuringSign Inc. d/b/a Cosmotown, a registrar sometimes associated with questionable domains. The site resolved to IP address 163.61.188.2 and used an SSL certificate issued by Let's Encrypt (R13), which is common among legitimate and malicious sites alike, providing a false sense of security. VirusTotal flagged goldrepublicvault.com as malicious by 4 out of 95 security vendors, and it appeared on 1 security blocklist. Additionally, AlienVault OTX included the domain in 1 threat intelligence pulse, indicating active monitoring by the security community. The page title was "GoldRepublic Vault - Home," further reinforcing the impersonation attempt.

Given that the site is now offline, the immediate risk to users is mitigated, but PhishDestroy recommends that anyone who may have visited goldrepublicvault.com or entered personal information should change their GoldRepublic account passwords immediately and monitor for suspicious activity. Users should always verify the authenticity of financial websites by checking the official URL directly and avoiding links from unsolicited emails or messages. PhishDestroy continues to monitor for related threats and advises reporting any similar domains to cybersecurity authorities.