persiangulfmoney[.]site

This domain, persiangulfmoney.site, is flagged as a phishing threat targeting cryptocurrency users, specifically those involved with TRX (Tron) mining. Analysis indicates the domain was registered on February 21, 2026, through NameCheap, Inc., and is currently offline. The page title, 'Hash TRX - Mining earn trx tron,' suggests an attempt to lure victims with promises of TRX mining rewards, a common tactic in cryptocurrency-related phishing schemes. Infrastructure analysis reveals the domain resolves to IP 66.29.153.222, hosted by Namecheap, Inc. (AS22612) in the United States, and employs Cloudflare for traffic routing, a frequent choice among threat actors to obscure malicious activity. The SSL certificate is issued by Sectigo Limited, a legitimate provider, but this does not mitigate the domain's malicious intent, as phishing sites often use valid certificates to appear trustworthy.

Detection data is limited but indicative of malicious activity. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist, specifically PhishDestroy. VirusTotal shows a single detection by one of 93 security vendors, which, while not conclusive, aligns with the domain's classification as a phishing threat. The use of technologies such as PHP, Bootstrap, LiteSpeed, and jQuery is consistent with phishing sites, though these tools are also common in legitimate web development. The domain's nameservers (dns1.namecheaphosting.com and dns2.namecheaphosting.com) are standard for NameCheap-hosted sites, offering no additional red flags beyond the registrar's association with the domain.

Defenders should treat this domain as an elevated-risk threat due to its cryptocurrency-themed phishing focus, offline status notwithstanding. While the domain is currently inaccessible, historical resolution to a Namecheap IP and the presence of a single detection on VirusTotal warrant continued monitoring.