keystone-gains[.]com

This domain, keystone-gains.com, is identified as a generic phishing site designed to deceive users with fraudulent investment opportunities. Analysis indicates no direct brand impersonation but employs social engineering tactics to mimic legitimate investor platforms. The domain is currently offline, though prior activity suggests it targeted users seeking rapid financial engagement under false pretenses. Infrastructure analysis reveals the domain was registered on May 28, 2026, through Spaceship, Inc., and resolved to the IP address 185.158.133.1. It is flagged by 9 of 95 VirusTotal security vendors, indicating broad detection across multiple threat intelligence sources. The domain appears on three security blocklists and was proactively blocked by at least three independent threat feeds. Technical indicators include the use of a Let's Encrypt SSL certificate, Cloudflare hosting, and HTTP Strict Transport Security (HSTS) headers, which may have been employed to lend an appearance of legitimacy. Current status confirms the domain has been taken offline, though residual risk remains for users who may have engaged with it prior to deactivation. Organizations and individuals are advised to block the domain and associated IP at the network perimeter. Users should verify investment platforms through official channels and avoid domains with recent creation dates or low trust scores. Security teams are recommended to monitor for related indicators, including the registrar (Spaceship, Inc.) and hosting IP (185.158.133.1), as threat actors may reuse infrastructure for future campaigns.