goldencapitalbank[.]org

The domain goldencapitalbank.org was registered through Dynadot LLC and first observed on February 21, 2026. The site presented the page title “Home - Golden Capital Bank,” indicating a targeted impersonation of a financial institution. Infrastructure analysis shows the domain resolves to the IPv4 address 198.251.84.200, which is hosted by AS53667 FranTech Solutions in the United States. The authoritative name servers are ns5.asurahosting.com and ns6.asurahosting.com, both consistent with the hosting provider. The web server responded over HTTP/3 and employed LiteSpeed as the underlying server software.

Front‑end assets were delivered using Tailwind CSS, Alpine.js, and jsDelivr, while the Smartsupp widget was also detected, suggesting the use of a live‑chat component. The TLS certificate is issued by Let’s Encrypt (R13), confirming that encryption was in place at the time of capture. VirusTotal analysis recorded 13 detections out of 93 scanned security vendors, providing a moderate level of consensus that the domain is malicious. The domain appears on a single public blocklist, PhishDestroy, and received a Gridinsoft trust score of 0 out of 100, reinforcing its classification as a high‑confidence threat. The overall risk rating has been assigned as elevated, and the site has since been taken offline, reducing immediate exposure.

Defenders should block the domain and its associated IP address at perimeter and DNS layers. Monitoring for the listed name servers and any future sub‑domains registered under the same registrar may reveal re‑use of the infrastructure. Because the site used a legitimate Let’s Encrypt certificate, reliance on certificate validity alone is insufficient for detection. Correlation of traffic to the observed technologies, especially LiteSpeed with HTTP/3 and the Smartsupp widget, can aid in identifying similar phishing deployments.