boldonwares[.]com

Analysis of the domain boldonwares.com indicates active phishing infrastructure with a high-risk classification. The domain, registered on January 4, 2025, through a registrar based in Japan, resolves to the IP address 91.92.241.31. As of July 12, 2026, ten out of ninety-five security vendors on a widely used threat intelligence platform have flagged this domain as malicious, while it appears on four distinct security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. The domain remains operational, serving content under the page title 'Boldonwares,' though the specific nature of the phishing campaign is not yet confirmed due to limited on-page analysis. Infrastructure review reveals the use of common web technologies, including Bootstrap, LiteSpeed, Smartsupp, Slick, and jQuery, alongside support for HTTP/3. The SSL certificate is issued by Let's Encrypt, a common provider for both legitimate and malicious sites. The domain has been referenced in twenty-three threat intelligence pulses, suggesting recurring or evolving malicious activity. Despite these indicators, the exact target of the phishing campaign—whether financial, credential-based, or otherwise—remains undetermined, as no specific brand or service is named in available metadata. Defenders should treat this domain as hostile until further analysis is conducted. Network-level blocking of 91.92.241.31 and the domain itself is recommended for organizations using the listed blocklists. Given the domain's persistence since early 2025 and its continued activity, monitoring for related domains or IP associations may help identify broader campaign infrastructure. Additional scrutiny of SSL certificate issuance patterns and hosting provider history could provide further context, though no anomalies in these areas are currently confirmed.