goldenaccess-ltds[.]com

The domain goldenaccess-ltds.com was registered on February 21, 2026 through Sav.com, LLC. It resolves to the IPv4 address 107.172.61.186, which is announced by AS36352 and resides in the United States. Hosting is provided by HostPapa, and the authoritative nameservers are ns5.sammiehost.com and ns6.sammiehost.com. The site presents a TLS certificate issued by Let’s Encrypt (R12) and advertises LiteSpeed with HTTP/3 support, indicating a modern web stack.

When accessed, the site issues an HTTP 302 redirect to a page whose title reads “Account Suspended.” The redirect behavior and the suspended‑account message are commonly used to lure victims into credential‑harvesting flows for account takeover campaigns. The observed infrastructure, combined with the short domain age and the use of a free certificate, suggests a deliberately disposable setup designed to evade long‑term detection.

Threat intelligence scores the domain as high risk. Ten out of ninety‑five security vendors on VirusTotal flag the domain, and it appears on one external blocklist. The Gridinsoft trust score is 0/100, underscoring its malicious reputation. Additionally, the domain is actively blocked by the PhishDestroy blocklist, confirming that defensive communities have identified it as part of an ongoing phishing operation targeting account takeover scenarios.

Defenders should block traffic to 107.172.61.186 and to the domain goldenaccess-ltds.com at network perimeters. Email and web security gateways must add the domain to URL and sender reputation lists. Incident response teams should monitor for credential submissions that reference the “Account Suspended” page and correlate them with known account takeover indicators. Continuous re‑evaluation of the domain’s status is advised, as the infrastructure can be repurposed or redirected to new malicious payloads.