# PhishDestroy threat dossier — gofatechnologies.xyz ================================================================ Fetched: 2026-07-29 05:04:19 UTC Canonical: https://phishdestroy.io/domain/gofatechnologies.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Forcepoint ThreatSeeker AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 103.224.212.108 (AU, Beaumaris) ASN: AS133618 Trellian Pty. Limited Hosting org: Trellian Pty. Limited Registrar: Global Domain Group LLC Nameservers: ["5772.ns1.abovedomains.com", "5772.ns2.abovedomains.com"] HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-09-26 Status: INVALID chain Fingerprint: cef25de7644b864909345e878c47ef12b92f56ee86284eee7d38eb8daab683c6 Subject Alternative Names (related infrastructure — often same operator): - 27346791.vip - 27625331.vip - 2yl1knb.xyz - 2yyqswx.xyz - 3318705.vip - 35828.wang - 3z2f8.lol - 47459949.vip - 4hu4638.xyz - 52388.mobi - 5588128.xyz - 668839280582.com - 818pbetapp.xyz - adonaimusicpro.com - ads1299d.com ... +28 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-26 09:33:08 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 04:20:33 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-26 09:34:10 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] gofatechnologies.xyz: Confirmed Phishing Site Targeting This domain, gofatechnologies.xyz, is flagged as a high-risk phishing site based on current threat intelligence. As of July 26, 2026, the domain remains active and is listed on one security blocklist, specifically PhishDestroy. Infrastructure analysis reveals the domain is hosted under nameservers 5772.ns1.abovedomains.com and 5772.ns2.abovedomains.com, with an HTTP status of 200, indicating the site is accessible. VirusTotal reports that 2 out of 91 security vendors detect this domain as malicious, though the specific nature of the threat—such as the targeted brand or phishing kit—has not been confirmed through available data. The domain was registered through Global Domain Group LLC, a registrar frequently associated with malicious domains, though no additional registrar abuse contacts or enforcement actions are documented. Defenders should treat this domain as an active phishing threat. The lack of widespread detection on VirusTotal does not indicate safety, as phishing domains often evade initial scans. The HTTP 200 status confirms the site is operational, and the single blocklist entry suggests early-stage detection. No brand impersonation or specific phishing kit has been identified in the available data, so the exact lure—whether corporate credentials, financial data, or other sensitive information—remains unconfirmed. Network-level blocking is recommended, particularly for organizations with exposure to domains registered under the above nameservers or Global Domain Group LLC. Monitoring for related domains using the same nameserver pattern may help identify additional threats. Further analysis of the site’s content is required to determine the precise phishing mechanism, but defenders should assume credential harvesting until proven otherwise. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: cef25de7644b864909345e878c47ef12b92f56ee86284eee7d38eb8daab683c6 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/gofatechnologies.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=gofatechnologies.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 192,492 domains (82,918 alive under monitoring, 107,787 confirmed takedowns/dead). Site: https://phishdestroy.io