app[.]goldentrustfundz[.]com

On July 24, 2026, the domain app.goldentrustfundz.com was observed serving a page titled “Account Login |”. The HTTP response returned status code 200, indicating the page loads without error. The site resolves to IP 198.12.80.250, which belongs to AS36352 operated by HostPapa in the United States. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a valid TLS chain. Nameservers dilbert.ns.cloudflare.com and lucy.ns.cloudflare.com show the domain is protected by Cloudflare, and traffic is delivered via HTTP/3.

Fingerprinting identified PHP, Bootstrap, and jQuery (served from a CDN) as the primary web stack components. Registrar information indicates the domain was registered through Dynadot LLC on February 21, 2026. Reputation checks show a Gridinsoft trust score of 0 out of 100 and that the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that eight of ninety‑three scanned security vendors flagged the host as malicious. The overall risk rating is high and the indicator remains active.

The available data confirm the infrastructure is intentionally crafted for credential harvesting, matching the “Credential Phishing” scam type. However, the exact target brand or service being spoofed cannot be determined from the current evidence, as the page title provides no brand name. Analysts should treat any login submission to this site as compromised and block network traffic to the host. Defensive measures include adding the IP address 198.12.80.250 and the domain name to endpoint and DNS blocklists, monitoring for similar Cloudflare‑protected domains using the same nameservers, and reviewing TLS certificate fingerprints for the Google Trust Services WE1 chain to detect reuse. Continuous re‑scanning with multi‑vendor engines is recommended to capture any changes in detection status.