poorgoat[.]fun

This report assesses the domain poorgoat.fun as of August 04, 2026. The domain is currently flagged as active and is classified as a generic phishing threat, with its risk level marked as under investigation. The primary evidence of malicious activity comes from its presence on one security blocklist, specifically PhishDestroy. This indicates that at least one independent threat intelligence source has identified the domain as associated with phishing operations.

Infrastructure analysis reveals that poorgoat.fun resolves to the IP address 216.198.79.1. No additional hosting details, such as autonomous system number or country of origin, are available in the current data set, so the hosting environment cannot be fully characterized. The domain was scanned by VirusTotal, which queried 91 security vendors; as of the report date, none of those vendors have flagged the domain as malicious. This absence of detections is noteworthy but is not conclusive proof of safety, as detection rates can lag behind newly deployed phishing infrastructure or vary based on vendor coverage.

The exact content hosted on poorgoat.fun has not yet been analyzed. There is no page title, brand target, or specific scam kit information in the available intelligence, so the precise nature of the phishing lure remains unknown. Defenders should treat this domain with caution due to the active blocklist listing, even though broader vendor consensus has not yet formed.

Recommended defensive actions include monitoring the domain for changes in resolution, checking for new subdomains, and reviewing any email or web traffic logs for references to poorgoat.fun. Organizations should block the domain at the DNS and proxy level until the investigation concludes. Users who have interacted with the domain should be alerted to the potential for credential harvesting or other phishing tactics, and any captured credentials should be considered compromised.