gorkaiofficial[.]xyz

The domain gorkaiofficial.xyz was registered on February 27, 2026 through NiceNIC International Group Co., Limited and is currently listed as offline. DNS resolution points to the IP address 104.21.66.187, which belongs to the Cloudflare network (AS13335). The authoritative nameservers are lynn.ns.cloudflare.com and walk.ns.cloudflare.com, indicating that the operator leveraged Cloudflare’s CDN and DNS services, a common tactic for obscuring true hosting location and for rapid takedown resistance. No SSL certificate was observed for the domain, suggesting that any malicious payload would have been delivered over unencrypted HTTP.

The sole page title retrieved was "Just a moment...", providing no direct indication of the phishing lure or targeted brand. Ten of ninety‑three security vendors on VirusTotal flagged the domain, and it appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL, confirming that multiple independent threat‑intelligence sources have identified the site as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. Given the limited public artifacts, the precise phishing campaign details—such as the targeted service, credential‑harvesting method, or any associated malware—remain unknown.

However, the combination of a recent registration, Cloudflare‑based hosting, lack of TLS, a generic page title, and multiple vendor detections aligns with typical infrastructure patterns employed by generic phishing operators. Defenders should continue to block the domain at network perimeters and update any URL filtering or threat‑intelligence feeds that reference gorkaiofficial.xyz. Monitoring for re‑registration or similar domains under the same registrar may provide early warning of renewed activity.