granddominiontrust[.]org

Analysis conducted on July 23, 2026 identifies the domain granddominiontrust.org as an inactive infrastructure associated with an investment‑type phishing campaign. The domain was registered on February 28, 2026 through Ultahost, Inc. and is hosted on a server located in Canada (Tor‑exit node indicated by “Tzulo‑TOR”) that resolves to IP address 198.54.132.28. The authoritative nameservers ns1‑ns4.ultahost.com resolve to the same provider, confirming the registrar’s hosting environment. TLS is supplied by a Let’s Encrypt R13 certificate, indicating that HTTPS was available while the site was operational.

Automated scanning by VirusTotal recorded 14 detections out of 94 security vendors, and the domain appears on a single external blocklist, confirming that at least some security products have flagged the site. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. The page title retrieved during the brief live check read “Home - Grand Dominion Trust,” matching the declared scam type of an investment fraud. Detected web technologies include PHP, Tailwind CSS, LiteSpeed, Alpine.js, Smartsupp, jsDelivr, and HTTP/3, all of which are commonly leveraged in phishing kits to render dynamic content and track visitors.

The domain is currently listed as offline by the monitoring service, and PhishDestroy has added it to its blocklist. Uncertainty remains regarding the specific payload delivered to victims, as no login forms or credential‑capture pages have been captured. Defenders should continue to block the IP 198.54.132.28 and the domain granddominiontrust.org at DNS and proxy layers, monitor for any re‑registration attempts, and update intrusion detection signatures to include the observed technology stack and the Let’s Encrypt certificate fingerprint. Ongoing observation of related subdomains and any resurgence of the hosting provider’s IP range is recommended.