r[.]goprox[.]cc

The domain r.goprox.cc has been identified as a generic phishing domain. It does not appear to be associated with any specific brand or drainer kit. The primary intent of this domain is to deceive users into providing sensitive information, such as login credentials or financial data.

Analysis indicates that r.goprox.cc has a VirusTotal score of 20/95, suggesting that a significant number of security vendors have flagged it as malicious. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IP address 217.60.5.87, which is located in France (FR) under the AS56971 Cloud. The domain was created on February 21, 2026, and appears on one security blocklist. Additionally, the SSL certificate is issued by Let's Encrypt, specifically under the R13 authority. The domain is currently listed as taken offline by PhishDestroy, a known security service.

The current status of r.goprox.cc is offline, which reduces the immediate risk to users. However, the infrastructure used to host this domain, including the registrar and IP address, should be monitored for any signs of reuse or similar malicious activities. Organizations and individuals are advised to update their security policies to block this domain and to educate users about the risks of generic phishing attacks. Despite the domain being offline, the potential for it to re-emerge remains, and vigilance is crucial to mitigate any residual threats.