goldenbkna[.]icu

Analysis of goldenbkna.icu indicates a high-risk phishing domain targeting credentials, currently active as of July 12, 2026. The domain was registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. It resolves to IP address 188.114.97.3, hosted on Cloudflare’s network in Canada, and uses Cloudflare nameservers (lewis.ns.cloudflare.com and treasure.ns.cloudflare.com). The SSL certificate is issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain is flagged by 2 of 94 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The HTTP response code is 403 (Forbidden), and the page title is 'Just a moment...', a generic placeholder often seen during Cloudflare challenge pages or when a site is in a transitional state. This suggests the phishing page may be either temporarily inaccessible, undergoing maintenance, or configured to evade automated detection tools. No specific brand or scam subtype (e.g., banking, social media, crypto) has been confirmed in available intelligence. The exact content of the phishing page remains unanalyzed, and no phishing kit or targeted brand is identified in the provided data. Defenders should treat this domain as an active threat and block it at the DNS or network level. Monitoring for changes in HTTP status or page content is recommended, as the domain may resume malicious activity. Further investigation into associated IP addresses, certificate reuse, and registrar history may reveal additional related infrastructure.