goofsj[.]lol

Analysis of the domain goofsj.lol indicates its involvement in a phishing campaign classified as an Airdrop Scam, as documented on July 23, 2026. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, currently resolves to the IP address 172.67.131.124, which is associated with AS13335 (Cloudflare, Inc.) and located in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (arushi.ns.cloudflare.com and rudy.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedown efforts. No SSL certificate was detected, increasing the risk of unencrypted data transmission between victims and the server.

At the time of assessment, the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 5 of 93 security vendors on VirusTotal, suggesting moderate detection coverage. The page title, 'goofsj.lol/', provides no additional context regarding the targeted brand or specific scam mechanics, and no further content analysis has been conducted. The domain has since been taken offline, though its prior activity aligns with known Airdrop Scam phishing kits, which typically lure victims with fraudulent cryptocurrency giveaways or token distributions.

Defenders should prioritize monitoring for residual DNS resolutions to 172.67.131.124 and assess any connections to Cloudflare-hosted infrastructure for similar patterns. Given the domain's registration through NiceNIC and its brief operational window, further investigation into the registrar's historical domains may uncover related campaigns. While the domain is no longer active, organizations should review logs for prior interactions and update blocklists to include the domain and associated IP to mitigate potential replay attacks.