paxgolds[.]com

Analysis of paxgolds.com shows multiple indicators of malicious activity consistent with a generic phishing operation. The domain was registered on 14 October 2025 through GRANSY S.R.O D/B/A SUBREG.CZ and is hosted on Cloudflare infrastructure, using the nameservers armfazh.ns.cloudflare.com and princess.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An SSL certificate issued by Google Trust Services (WE1) is present, but the HTTP response returns a 403 Forbidden status and the page title is "403 Forbidden," indicating that the site is currently taken offline.

Despite the offline state, the domain appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer. AlienVault OTX includes the domain in one threat‑intel pulse, and VirusTotal records 13 detections out of 95 scanned security vendors, reinforcing the malicious assessment. The combination of blocklist presence, multiple vendor detections, and the recent creation date suggests intentional use for phishing rather than a benign site.

Uncertainty remains regarding the exact phishing payload or target brand, as no page content beyond the 403 title has been captured. Defensive teams should continue to block paxgolds.com at perimeter devices, update URL filtering rules, and monitor for any re‑activation of the domain. Threat intel feeds should be refreshed to capture any new indicators, and any observed traffic to the associated IP address should be investigated for potential credential harvesting attempts.