mass.report
Scan Intelligence Report0/100
critical Risk
www.malbongolfus.com
https://www.malbongolfus.com/my-account/
IP
104.21.4.35 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
327 days
HTTP
200 · 48.5s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Malbon Golf Shop
Vendors
3/3
Status
completed
✓ spamhaus✓ kaspersky✓ google
Registered-domain escalation
Submit malbongolfus.com as the primary IOC, enriched with evidence from hostile subdomains like www.malbongolfus.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Malbon Golf Shop
Credential PhishingE-Commerce · 7/19/2026
Summary
The page presents a My Account login/register interface on the domain malbongolfus.com. Visual cues from the screenshot show Malbon Golf branding, a two-column login/registration form, and a footer with legitimate-looking navigation. The static HTML indicates a login form with password field and multiple POST endpoints, but the domain appears to be a real site rather than an impersonation of a well-known brand; however, the hosting domain name is suspicious (malbongolfus.com) and the WHOIS shows a recent creation date and short domain age, which can be indicative of a newly registered domain attempting to harvest credentials. The combination of credential fields, POST to get_refreshed_fragments, and external script loading warrants caution for potential credential harvesting on a first-party site that is itself young or misconfigured.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸Canonical stage contains password collection UI.
▸POST targets observed during capture: https://www.malbongolfus.com/?wc-ajax=get_refreshed_fragments.
▸Distinctive asset clues: hooks.min.js, zxcvbn-async.min.js, select2.css, style.css, 1.jpg, 1f31f.svg.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 5
Password fields: 2
Late-stage login UI: No
Resource Signals
Resources: 92
Hosts: 4
Domains: 4
Suspicious Endpoints
hxxps://www[.]malbongolfus[.]com/
hxxps://www[.]malbongolfus[.]com/my-account/
Attack Techniques (4)
Credential collection UI (password field, login form) on a page that visually mimics a brand's account surfacePOST requests to get_refreshed_fragments endpoint, suggesting dynamic page fragment loading potentially used to harvest dataHigh external script count and inclusion of password-strength and i18n librariesSPA-like behavior with multiple POST forms and a mix of assets from WordPress/WooCommerce ecosystem
Indicators of Compromise (7)
▸Page title: My account | Malbon Golf Shop
▸Branding in screenshot matches Malbon Golf branding
▸Domain malbongolfus.com with WordPress/WooCommerce assets
▸Login form present with password field
▸POST to /?wc-ajax=get_refreshed_fragments
▸External script sources including hooks.min.js, i18n.min.js, jquery, wc-blockui, password-strength-meter
▸Prefetch/inline Rank Math SEO metadata on a WordPress site
Risk AssessmentUsed in abuse reports
The page shows a legitimate-looking account surface for Malbon Golf Shop with a login form and password field, which could facilitate credential entry. However, the domain malbongolfus.com is newly created (327 days) with a recent SSL and Cloudflare protection, and the WHOIS indicates a short registration window. The presence of a login UI on this domain, the POST endpoint to refresh fragments, and a high volume of external scripts create risk for credential harvesting or session manipulation. Given the visual impersonation potential and the suspicious domain age, this warrants cautious handling and monitoring, with consideration of further verification of the site’s ownership and hosting origin.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API