golfiuns[.]biz

PhishDestroy identifies golfiuns.biz as an active crypto drainer phishing domain currently engaged in malicious activity. The domain mimics legitimate services to deceive users into connecting cryptocurrency wallets, resulting in unauthorized fund transfers. Security monitoring systems have flagged this domain with an elevated risk level, indicating active exploitation in the threat landscape.

This domain was flagged by 1 of 95 VirusTotal security vendors, demonstrating limited but confirmed malicious activity. The domain resolves to IP address 188.114.96.3 and operates under an SSL certificate issued by Google Trust Services, increasing its perceived legitimacy. Registered through CNOBIN INFORMATION TECHNOLOGY LIMITED on April 10, 2026, the domain has already been blocked by one security blocklist provider, ScamSniffer. Despite its recent creation, the domain’s infrastructure leverages trusted SSL certificates to enhance credibility among potential victims.

Security teams should immediately block golfiuns.biz at the network perimeter and update DNS blocklists to prevent further exposure. Users should be alerted to avoid interacting with this domain or any associated IP addresses. Additionally, organizations should monitor for any signs of wallet connection attempts to this domain, as it may indicate attempted crypto drainer activity. Enhanced monitoring of outbound traffic to this IP is strongly recommended to prevent financial losses.