trade-goldfishgold[.]com

Analysis of trade-goldfishgold.com shows that the domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑hosted address 104.21.2.223 (AS13335, United States). The site presented the HTTP title “Just a moment…”, and no TLS certificate was observed, indicating that connections were not encrypted. VirusTotal records indicate that 2 of 93 scanning engines have flagged the domain, and the domain is listed on at least one external blocklist and is actively blocked by the PhishDestroy sinkhole.

The domain is currently offline, which limits real‑time verification of content, but the combination of a recent registration, Cloudflare front‑end, lack of HTTPS, and the “Just a moment…” title are consistent with typical credential‑harvesting pages that rely on JavaScript redirects or Cloudflare challenge pages. Defenders should continue to monitor the IP address 104.21.2.223 for any resurgence of activity, enforce outbound filtering to block DNS resolution of the domain, and add the domain to internal blocklists. Because the hosting provider is Cloudflare, any future re‑use of the same IP may be unrelated, so correlation should rely on the fully qualified domain name rather than the IP alone.

The lack of a certificate and the minimal detection coverage (only two vendor flags) suggest that the site may have been short‑lived, but the presence on a known phishing blocklist indicates that threat actors have already deployed it against targets. Organizations should treat any emails or messages referencing “goldfishgold” or similar branding with heightened scrutiny, and incident response teams should collect any logs that show connections to this domain for further forensic analysis.