# PhishDestroy domain threat record: gocrehberi.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gocrehberi.com/
Machine-readable companion: https://phishdestroy.io/domain/gocrehberi.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 00:45:16 UTC
- Last availability or vendor check: 2026-10-28 12:13:29 UTC
- Stored record updated: 2026-10-28 12:13:29 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: NAMECHEAP INC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2019-09-04 09:17:20 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17ff8-5b29-73fb-9846-068ac632cf34/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gocrehberi.com
- Certificate Transparency search: https://crt.sh/?q=%25.gocrehberi.com
- Web Archive lookup: https://web.archive.org/web/*/https://gocrehberi.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added gocrehberi.com to its internal blocklist on 2026-10-28 after its intake flagged the domain because VirusTotal reported 14 malicious detections. The recorded page title is “Göç Rehberi | Yurtdışına taşınmak için nereden başlamalı?” and an HTTP 200 response was observed on the same date.

How the scam works
The detections that triggered the listing are categorized as phishing or malware, which generally involve presenting deceptive content to harvest credentials or deliver malicious payloads, but no specific malicious behavior was observed on the captured page.

Evidence
VirusTotal analysis on 2026-10-19 listed 14 malicious and 3 suspicious detections out of 92 engines, with vendors such as BitDefender, ESET and Fortinet labeling it phishing. Google Safe Browsing checked on 2026-10-28 did not flag the site. URLScan captured the site on 2026-05-20 with a clean verdict, and on 2026-10-28 the engine score was 63 and marked malicious, while the overall verdict remained non‑malicious. Cloudflare Radar scan on 2026-10-28 returned a malicious verdict and categorized the domain as phishing and malware. OTX recorded one pulse on 2026-10-28, external blocklists showed no entries, and PhishDestroy’s internal list marked the domain as blocked on 2026-10-28.

Infrastructure
The domain was registered on 2019-09-04 through NameCheap, Inc. It is served behind Cloudflare, resolving to the IPs 188.114.97.3 and 188.114.96.3, both associated with Cloudflare, Inc. in the United States. TLS is provided by Google Trust Services, valid from 2026-09-06 to 2026-12-05, and DNSSEC is not enabled. Authoritative nameservers are john.ns.cloudflare.com and sasha.ns.cloudflare.com, and MX records point to registrar‑provided forwarding hosts.

What to do
Visitors should treat gocrehberi.com as untrusted and avoid entering any personal or credential information. If credentials were submitted, change the associated passwords immediately. Security teams should block the domain at the perimeter, monitor outbound connections to the recorded IPs, and log any access attempts for further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17ff8-5b29-73fb-9846-068ac632cf34/
Cloudflare Radar report: https://radar.cloudflare.com/scan/cc5f076f-8200-4144-8d4e-78bc909d745b
Stored capture screenshot: https://i.ibb.co/RGf0wfTW/7774765ea984.png
Cloudflare Radar screenshot (2026-10-28T00:47:19Z): https://screenshots.phishdestroy.io/cf/cc5f076f-8200-4144-8d4e-78bc909d745b.png
URLScan screenshot (2026-05-19T15:15:28Z): https://screenshots.phishdestroy.io/us/019e40ce-4928-7760-837d-2307876319cc.png
URLScan capture report: https://urlscan.io/result/019e40ce-4928-7760-837d-2307876319cc/
URLScan screenshot (2026-05-20T08:40:52Z): https://screenshots.phishdestroy.io/us/019e448b-645a-7437-b387-9162e025b4e3.png
URLScan capture report: https://urlscan.io/result/019e448b-645a-7437-b387-9162e025b4e3/
VirusTotal report: https://www.virustotal.com/gui/domain/gocrehberi.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gocrehberi.com
Archived copy: https://web.archive.org/web/20261028004644/https://gocrehberi.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 00:52:11 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/RGf0wfTW/7774765ea984.png
  Captured: 2026-10-28 00:46:53 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17ff8-5b29-73fb-9846-068ac632cf34.png
  Captured: 2026-10-28 00:46:53 UTC
  Source report: https://urlscan.io/result/01a17ff8-5b29-73fb-9846-068ac632cf34/
- URLScan · 2026-05-20: https://screenshots.phishdestroy.io/us/019e448b-645a-7437-b387-9162e025b4e3.png
  Captured: 2026-05-20 08:40:52 UTC
  Source report: https://urlscan.io/result/019e448b-645a-7437-b387-9162e025b4e3/
  SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32
- URLScan · 2026-05-19: https://screenshots.phishdestroy.io/us/019e40ce-4928-7760-837d-2307876319cc.png
  Captured: 2026-05-19 15:15:28 UTC
  Source report: https://urlscan.io/result/019e40ce-4928-7760-837d-2307876319cc/
  SHA-256: 4a4697f6bf8e04eb88f48727552946ca2b9bcdefa0f2c9f52a4823fcfc85fe32
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cc5f076f-8200-4144-8d4e-78bc909d745b.png
  Captured: 2026-10-28 00:47:19 UTC
  Source report: https://radar.cloudflare.com/scan/cc5f076f-8200-4144-8d4e-78bc909d745b
  SHA-256: df3f1c7b70d2726971abe4a555b4d7cbb743056a80989ff84fd66a6123bf910c
- URLQuery: https://screenshots.phishdestroy.io/uq/e4e08f23-1e9b-4e7a-8892-0740186c870b.png
  Source report: https://urlquery.net/report/e4e08f23-1e9b-4e7a-8892-0740186c870b
  SHA-256: 8bf263e41426d0efd8918e3ab9ab2ac37160f62b07c56c993b5adcaee4284d2e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T00:51:06Z",
        "uuid": "01a17ff8-5b29-73fb-9846-068ac632cf34",
        "scanned_at": "2026-10-28T00:45:50Z",
        "final_url": "https://gocrehberi.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gocrehberi.com/",
                "from": "http://gocrehberi.com/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "ips": [
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "f43818a7d0347652ca4aef1dce9059d277667994517a5761490b2145844f7688",
        "tls": {
            "san": [
                "gocrehberi.com",
                "*.gocrehberi.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gocrehberi.com",
            "protocol": "QUIC",
            "valid_to": "2026-12-05T17:01:06Z",
            "valid_from": "2026-09-06T16:02:17Z"
        },
        "domain_age_days": 2608,
        "apex_age_days": 2608,
        "tls_age_days": 51,
        "tls_valid_days": 90,
        "requests": 10,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 63,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=86400",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer",
            "permissions-policy": "camera=(), microphone=(), geolocation=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T00:51:09Z",
        "uuid": "cc5f076f-8200-4144-8d4e-78bc909d745b",
        "scanned_at": "2026-10-28T00:47:19Z",
        "final_url": "https://gocrehberi.com/",
        "status": 200,
        "history": [
            {
                "url": "https://gocrehberi.com/",
                "status": 200
            }
        ],
        "dom_hash": "f602eb738c25f6f79c3a67a7b9925db3dd6205810a3d4212307509efd07ecdad",
        "doc_hash": "ca4e91ef2af5e584bd9fd70e6d3b976f355defecb62ef5ba401e51636f7b3831",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gocrehberi.com",
                "type": "A",
                "value": "172.67.199.105"
            },
            {
                "name": "gocrehberi.com",
                "type": "A",
                "value": "104.21.84.243"
            },
            {
                "name": "gocrehberi.com",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:c769"
            },
            {
                "name": "gocrehberi.com",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:54f3"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.12",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2019-09-04T11:17:20Z",
            "updated": "2026-09-06T17:00:33Z",
            "expires": "2027-09-04T11:17:20Z",
            "nameservers": [
                "john.ns.cloudflare.com",
                "sasha.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T00:46:24Z",
        "analysis_at": "2026-10-19T17:52:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "popularity": {
            "Alexa": 635360,
            "Statvoo": 635360,
            "Cisco Umbrella": 772995
        },
        "registrar": "NAMECHEAP INC",
        "created": "2019-09-04T11:17:20Z",
        "expires": "2027-09-04T11:17:20Z",
        "updated": "2026-09-06T17:00:33Z",
        "first_seen": "2026-05-19T04:22:20Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "john.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:54f3"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward1.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.84.243"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward3.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:c769"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward5.registrar-servers.com",
                "priority": 20
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.199.105"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sasha.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "john.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward2.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward4.registrar-servers.com",
                "priority": 15
            }
        ],
        "dns_at": "2026-10-19T17:57:27Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "gocrehberi.com",
                "*.gocrehberi.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "18c6c44184d547060e807d0fccfe37e3",
            "sha256": "42f77c641ed33f5aa78f91a5526a92489e86897e725c651430654f8749821e57",
            "subject": "gocrehberi.com",
            "valid_to": "2026-12-05T17:01:06Z",
            "valid_from": "2026-09-06T16:02:17Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2019-09-04T11:17:20Z",
            "updated": "2026-08-25T23:21:40Z",
            "expires": "2027-09-04T11:17:20Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "john.ns.cloudflare.com",
                "sasha.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-25T23:21:40Z",
                "registration": "2019-09-04T11:17:20Z",
                "registrar expiration": "2027-09-04T11:17:20Z",
                "last update of RDAP database": "2026-10-18T17:52:20Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T00:51:25Z",
        "mail_config": {
            "mx": [
                "eforward5.registrar-servers.com",
                "eforward1.registrar-servers.com",
                "eforward2.registrar-servers.com",
                "eforward3.registrar-servers.com",
                "eforward4.registrar-servers.com"
            ],
            "spf": "v=spf1 include:spf.efwd.registrar-servers.com ~all",
            "dmarc": true,
            "spf_lookups": 1
        },
        "caa_records": {
            "domain": "gocrehberi.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-28T00:46:44Z",
            "first": "2006-06-15T01:22:04Z",
            "changes": 13,
            "days_archived": 23,
            "scans_per_day": 0,
            "avg_page_bytes": 3076
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true
        },
        "security_txt": {
            "present": true,
            "found_in": "/.well-known/security.txt"
        },
        "social_tags": {
            "ogUrl": "https://gocrehberi.com/",
            "title": "Göç Rehberi | Yurtdışına taşınmak için nereden başlamalı?",
            "ogType": "website",
            "robots": "noindex, nofollow",
            "ogTitle": "Göç Rehberi | Yurtdışına taşınmak için nereden başlamalı?",
            "ogSiteName": "Göç Rehberi",
            "themeColor": "#101828",
            "description": "Yurtdışına taşınmayı düşünüyorsanız, ilk adımlarınızı saatlerce farklı sayfalarda kaybolmadan netleştirin.",
            "twitterCard": "summary",
            "canonicalUrl": "https://gocrehberi.com/",
            "ogDescription": "Yurtdışına taşınmayı düşünüyorsanız, ilk adımlarınızı saatlerce farklı sayfalarda kaybolmadan netleştirin."
        },
        "trackers": {
            "requests": 8
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 6,
                "tls": 13,
                "wait": 40,
                "connect": 17,
                "download": 1
            },
            "response_ms": 77
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 14927,
            "co2_grams": 0.0005,
            "cleaner_than": 63
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.194.69",
                    "host": "sasha.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.193.185",
                    "host": "john.ns.cloudflare.com"
                }
            ],
            "zone": "gocrehberi.com"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Washington",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "gocrehberi.com"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "MX": [
                "{\"exchange\": \"eforward2.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward5.registrar-servers.com\", \"priority\": 20}",
                "{\"exchange\": \"eforward4.registrar-servers.com\", \"priority\": 15}",
                "{\"exchange\": \"eforward3.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward1.registrar-servers.com\", \"priority\": 10}"
            ],
            "NS": [
                "john.ns.cloudflare.com",
                "sasha.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"john.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416723835, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            ],
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=86400",
            "message": "HSTS max-age is 86400, below the 31536000 minimum."
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": "no-referrer",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=86400",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://gocrehberi.com"
            ]
        },
        "subdomains": {
            "count": 2,
            "subdomains": [
                "mail.gocrehberi.com",
                "www.gocrehberi.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Astro",
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 2
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2019-09-04T11:17:20Z",
            "updated": "2026-09-06T17:00:33Z",
            "expires": "2027-09-04T11:17:20Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "john.ns.cloudflare.com",
                "sasha.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=86400",
                "x-frame-options": "DENY",
                "x-content-type-options": "nosniff",
                "referrer-policy": "no-referrer",
                "permissions-policy": "camera=(), microphone=(), geolocation=()"
            }
        }
    }
}
```