access[.]westgoldbnk[.]com

Analysis of access.westgoldbnk.com shows that the domain was registered on 21 February 2026 through Global Domain Group LLC and is hosted on IP 23.95.132.226, an address assigned to AS36352 (HostPapa) in the United States. The site served content over HTTPS using a Let’s Encrypt R13 certificate, indicating a valid TLS handshake at the time of capture. HTTP fingerprinting identified an Apache HTTP Server stack running PHP and a front‑end built with jQuery, jQuery UI and jQuery CDN, together with Google Tag Manager and Contentsquare scripts. The page title returned the string “mamma”, which does not correspond to any known brand or service and provides no indication of the intended victim target.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious behavior. VirusTotal recorded a single positive detection out of 93 scanned engines, and the domain appears on one external blocklist, which has been enforced by the PhishDestroy sinkhole. Nameservers are hosted by abovedomains.com (5014.ns1 and 5014.ns2). The domain is currently offline, and no further HTTP response details are available.

The observable indicators confirm that the infrastructure was deliberately configured to host a phishing page, but the limited public scanning (one vendor flag) and the absence of additional threat‑intel references leave the full scope of the campaign uncertain. Defenders should block the IP address 23.95.132.226 and the associated nameservers, monitor for newly created subdomains under the same registrar, and enforce TLS inspection to detect any future re‑use of the certificate. Updating local blocklists with the reported domain and adding the observed hash of the page title “mamma” to detection rules will help mitigate similar attempts. Continued observation of the HostPapa hosting environment is advised, as the provider may be leveraged for other short‑lived phishing sites.