golden77[.]co

Analysis of the domain golden77.co indicates a brand impersonation campaign targeting Ethereum users, classified with an elevated risk level. The domain was registered on January 20, 2024, through Cloudflare, Inc., and is currently offline as of the report date. Infrastructure analysis reveals the domain resolves to the IP address 104.21.58.241, hosted on Cloudflare's network (AS13335) in the United States. Nameservers associated with the domain are lakas.ns.cloudflare.com and stella.ns.cloudflare.com, further confirming Cloudflare as the infrastructure provider. The page title, 'Golden77.co – Обменный пункт электронных валют,' suggests the site was presented as a currency exchange service, aligning with the observed scam type of brand impersonation.

No SSL certificate was detected for this domain. Detection metrics from security vendors indicate limited but notable visibility: 11 of 95 vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The domain is also blocked by PhishDestroy, reinforcing its classification as a threat. Defenders should note the domain's use of Cloudflare infrastructure, which may complicate takedown efforts or attribution.

The absence of an SSL certificate is atypical for financial or cryptocurrency-related services and may serve as an additional indicator of malicious intent. While the domain is currently offline, historical resolutions and detection data suggest it was actively used in a phishing campaign. Organizations are advised to monitor for related domains leveraging similar naming conventions or infrastructure patterns, particularly those impersonating cryptocurrency platforms. Further investigation into the domain's hosting history and associated threat actor infrastructure may provide additional context for mitigation strategies.