goldenportcapital[.]com

Analysis of the domain goldenportcapital.com indicates active brand impersonation targeting financial investment platforms, specifically those associated with gold trading or precious metals. The domain was registered on April 22, 2026, through NAMECHEAP INC, a registrar frequently observed in phishing campaigns. Infrastructure analysis reveals hosting by Alexhost SRL in Moldova, resolving to the IP address 176.123.0.199. Nameservers ns7.alexhost.com and ns8.alexhost.com further confirm the hosting provider's involvement, a pattern consistent with known malicious infrastructure. The domain is flagged on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and has been identified in one threat intelligence pulse on AlienVault OTX. The page title, 'Goldenport Capital | Secure and Profitable Gold Investment Platform,' explicitly suggests an attempt to mimic legitimate investment services, though the exact content and functionality of the site remain unanalyzed. A Gridinsoft trust score of 0/100 reinforces the high-risk classification. Technical indicators include the use of a Let's Encrypt SSL certificate (R12), PHP, Bootstrap, LiteSpeed, and additional JavaScript libraries such as GSAP, Swiper, Select2, and jQuery, alongside HTTP/3 support. The HTTP status code 302 suggests potential redirection activity, though the destination remains unverified. MX records point to the domain itself, which may be leveraged for credential harvesting or further phishing operations. Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Given its presence on multiple blocklists and association with known malicious hosting providers, organizations should monitor for related indicators of compromise, including the IP address 176.123.0.199 and the Alexhost nameservers.