premiumgoldinvestor[.]com

This domain, premiumgoldinvestor.com, is flagged as an active investment scam phishing site. Registered on October 9, 2025, it remains operational as of July 12, 2026, resolving to IP address 192.3.190.186 under AS36352 (HostPapa). The site presents itself with the page title 'Premium Gold Investor - Home,' aligning with the known scam classification of an investment fraud operation. Infrastructure analysis reveals the use of Firebase, Bootstrap, LiteSpeed, and multiple JavaScript libraries including jQuery and Swiper, alongside Google Analytics for tracking. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. The domain is currently listed on one security blocklist and has been flagged by 3 out of 95 security vendors on VirusTotal. While this detection rate is not overwhelming, it confirms active scrutiny by at least one reputable security provider. The registration details point to Cosmotown, Inc. as the registrar, and the nameservers are dns1.webproserver.com and dns2.webproserver.com, which may be relevant for defenders monitoring related infrastructure. The HTTP status returns a 200 code, indicating the site is accessible without immediate technical barriers. Defenders should treat this domain as high-risk due to its confirmed investment scam classification and active status. The combination of financial-themed branding, low trust scores, and detection by security vendors warrants immediate blocking at the network level. Organizations should also monitor for any attempts to contact users via email or other vectors, as this domain may be part of a broader campaign. The exact content and user interaction flow of the site have not been analyzed, so additional indicators such as form fields, payment requests, or credential harvesting techniques remain uncertain. Proactive DNS and HTTP filtering are recommended to mitigate potential exposure.