reagangoldgroupira[.]com

Analysis of the domain reagangoldgroupira.com indicates a high-risk phishing infrastructure targeting entities associated with Reagan Gold Group, as suggested by the page title. The domain was registered on April 14, 2026, through NameCheap, Inc., and currently resolves to the IP address 216.150.1.1. It is actively flagged on two security blocklists (PhishDestroy and BLP-Malware) and appears in 24 threat intelligence pulses on AlienVault OTX, demonstrating widespread detection in security communities. Eight of 95 security vendors on VirusTotal have flagged the domain, reinforcing its malicious classification. The SSL certificate is issued by Let's Encrypt, a common but not inherently suspicious provider often exploited in phishing operations. Infrastructure analysis reveals the use of Vercel hosting and HSTS implementation, which may be employed to lend an appearance of legitimacy. The presence of YouTube integration suggests potential social engineering tactics, though the exact content of the site remains unanalyzed. The domain's Gridinsoft trust score of 0/100 further corroborates its high-risk status. While the specific phishing methodology or targeted brand impersonation cannot be confirmed without deeper content analysis, the domain exhibits multiple indicators of fraudulent intent. Defenders are advised to block this domain at the network level, monitor for related infrastructure, and alert potential targets of Reagan Gold Group-themed phishing attempts. The domain remains active as of July 12, 2026, and should be treated as a live threat.