h5[.]ctgoldi[.]com

The domain h5.ctgoldi.com was registered on March 03, 2026 through GMO Internet, Inc. and is currently hosted on the IP address 188.114.97.3. Its authoritative name servers are demi.ns.cloudflare.com and george.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, which classifies it as a phishing resource. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors; at the time of analysis no vendor has raised a detection, but the absence of detections does not constitute evidence of safety.

No public data were found regarding SSL certificate details, HTTP response codes, Safe Browsing status, Open Threat Exchange references, or page title content, so those aspects remain unknown. The limited visibility of the infrastructure suggests a recent creation date and rapid deployment, a pattern often associated with short‑lived phishing campaigns. Defenders should continue to monitor the domain, enforce blocklist rules that already flag it, and consider adding it to internal deny lists.

Network traffic to 188.114.97.3 should be inspected for anomalous or credential‑harvesting activity. Because the site’s content and exact phishing vector have not been publicly disclosed, additional investigation—such as sandboxed browsing or URL‑level crawling—may be required to determine the specific brand or credential targets. Until more detailed evidence emerges, precautionary blocking and heightened telemetry on connections to this domain are recommended.