What Gridinsoft observed on goldmountaingolf.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903025100-d840ea64
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Phishing
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The legitimate golf-course content does not make this request a false positive. A checkout-targeted loader capable of injecting third-party JavaScript into a live card-payment form is directly reproducible and has persisted in archived and current pages. The existing Phishing classification is retained. The unavailable second-stage endpoint limits claims about the payload currently delivered, but does not negate the site-code compromise.
Analyst findings
Review 5 documented observations View evidence
The reviewed site presented the expected Gold Mountain Golf Club content. Its public sitemap exposed normal golf, restaurant, event, store, cart, and checkout routes; no unrelated automatic top-level redirect or executable download was reproduced in the reviewed navigation.
-
HTTP status
200 -
Final URL
https://goldmountaingolf.com/ - Analyst observation The visible operator content is consistent with a golf-course and hospitality website, but that legitimate presentation does not remove the separate checkout code compromise.
A script element identified as gli0 was present in the live site footer. It checks whether the browser path contains checkout, sends a POST request to https://brisca.sbs/, decodes the response as a JavaScript source URL, and adds that external script to the page. The same injected loader was reproduced on ordinary pages, while its conditional behavior targets the checkout path.
- Page element script element id gli0
- Public artifact URL https://brisca.sbs/
- Analyst observation The loader dynamically adds a third-party JavaScript source only when the current pathname includes checkout.
After adding a currently listed product to a temporary cart, the checkout returned HTTP 200 and displayed fields for the card number, expiration month and year, and card security code. The checkout-targeted external loader was present in that same response.
-
HTTP status
200 -
Final URL
https://goldmountaingolf.com/checkout/ - Page element Credit Card number, Expiration date, and Card security code fields
The external loader endpoint returned DNS NXDOMAIN from two independent network locations. No payload URL, payload bytes, file hash, credential submission, or card-data transmission could therefore be retrieved or observed during this review.
- DNS fact brisca.sbs returned NXDOMAIN for A, AAAA, and NS queries
- Analyst observation No current second-stage script or payload hash was available for analysis.
Archived homepage snapshots from 2017, 2019, 2022, January 2025, and July 2, 2025 did not contain the gli0 loader. A snapshot from October 11, 2025 contained the same checkout-targeted loader and https://brisca.sbs/ endpoint, as did later reviewed snapshots from November 2025 and May and June 2026.
- Public artifact URL https://web.archive.org/web/20250702200013/https://goldmountaingolf.com/
- Public artifact URL https://web.archive.org/web/20251011153447/https://goldmountaingolf.com/
- Analyst observation The reviewed archive establishes introduction between July 2 and October 11, 2025 and persistence into the current site; it does not establish when the unavailable second stage was active.
Scope and limitations
- The exact second-stage payload could not be retrieved because brisca.sbs returned NXDOMAIN during the review.
- No completed payment or real card data was submitted; the checkout was reviewed with a temporary cart and without placing an order.
- The archive timeline establishes when the loader was absent and present in reviewed snapshots, not the complete activation history of the remote payload.
- The result applies to the domain and public checkout behavior observed at the recorded time; remediation requires removal of the injected code and a fresh exact-flow review.
Help protect others by sharing this page on social media! The more people who know about goldmountaingolf.com, the fewer chances they have to deceive someone else. Help others evaluate goldmountaingolf.com by sharing this page on social media!