golden-oasis[.]com

golden-oasis.com was registered on July 01, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv4 address 69.5.189.54, which is assigned to AS42624 (Global-Data System IT Corporation) in Switzerland. The domain is currently taken offline, as indicated by the status flag and by the PhishDestroy block. It appears on one security blocklist and has a Gridinsoft trust score of 0 / 100, reflecting a high confidence of malicious intent. AlienVault OTX lists the domain in a single threat‑intelligence pulse, and four of ninety‑five VirusTotal scanners have flagged it, confirming detection by multiple vendors.

No SSL certificate is presented, meaning the site would have been served over plain HTTP, a common characteristic of low‑effort phishing operations. The page title observed during a brief crawl reads “GOLDEN‑OASIS | Play at the best online casino based on Blockchain”, and the associated phishing kit is identified as “Gambler Scam”, classifying the campaign as a crypto‑focused gambling fraud. Nameservers ns1‑ns4.nameserverhub.com are used, which are often leveraged by disposable or fast‑flux infrastructures.

Concrete evidence of the payload or credential‑stealing pages is not available because the site is offline, so the exact content and any victim interaction remain uncertain. Defenders should continue to block the domain at perimeter filters, add the IP address 69.5.189.54 to deny‑list rules, and monitor for any look‑alike registrations that reuse the “golden‑oasis” branding. Threat‑intel platforms should update their indicators of compromise with the domain, IP, and associated kit name, and SOC analysts should watch for outbound traffic to the listed IP range that could indicate compromised clients attempting to reach the takedown site.