# PhishDestroy domain threat record: goge.win

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/goge.win/
Machine-readable companion: https://phishdestroy.io/domain/goge.win/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 14:46:30 UTC
- Last availability or vendor check: 2026-10-23 14:58:12 UTC
- Stored record updated: 2026-10-23 17:19:36 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Dynadot Inc
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 302
- Registration date (registry RDAP, goge.win): 2026-01-02 00:47:42 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16943-28f9-7347-921a-842842a76460/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/goge.win
- Certificate Transparency search: https://crt.sh/?q=%25.goge.win
- Web Archive lookup: https://web.archive.org/web/*/https://goge.win/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake system marked goge.win on 2026-10-23 after a fresh URLScan capture returned a malicious verdict and an AI model assigned a high phishing confidence. The recorded page title advertises "GOGE | Play at the best online casino based on Blockchain" and the excerpt describes a decentralized crypto gaming platform offering bonuses. The site presented an HTTP 302 redirect on the same date, indicating it was actively serving traffic. PhishDestroy added the domain to its internal blocklist based on this assessment.

How the scam works
Crypto‑casino phishing sites lure visitors with promises of blockchain‑based games, high bonuses or provably fair gambling and then request wallet connections or personal credentials. Victims who comply may have crypto assets transferred out of their wallets or their accounts compromised.

Evidence
URLScan’s analysis on 2026-10-23 classified the final URL as malicious with a 100 % score, labeling it as phishing and associating it with the Crypto Scam brand. VirusTotal scanned the domain on 2026-10-23 and reported zero detections from 92 engines. Google Safe Browsing checked on the same date and did not flag the site. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed no entries on the check date. OTX listed three pulses mentioning goge.win.

Infrastructure
The domain was registered on 2026-01-02 through Dynadot Inc, making it 294 days old at first sighting. The recorded IP address 188.114.96.3 belongs to Cloudflare’s network in Canada. TLS inspection on 2026-10-21 found a Let’s Encrypt certificate valid until 2027-01-19 for *.goge.win. Cloudflare is listed as the hosting provider.

What to do
Users should avoid entering any credentials or connecting crypto wallets to goge.win and, if they have already done so, should monitor their assets for unauthorized activity. Organizations can block the domain in web‑filtering solutions and review access logs for connections to the recorded hostname.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16943-28f9-7347-921a-842842a76460/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b779ffb5-d15d-4728-87fd-651762d31405
URLQuery report: https://urlquery.net/report/ac504fff-e2a3-4193-b557-df0c309e2665
Stored capture screenshot: https://urlscan.io/screenshots/01a16943-28f9-7347-921a-842842a76460.png
Cloudflare Radar screenshot (2026-10-23T14:50:39Z): https://screenshots.phishdestroy.io/cf/b779ffb5-d15d-4728-87fd-651762d31405.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/ac504fff-e2a3-4193-b557-df0c309e2665.png
URLScan screenshot (2026-10-22T17:44:19Z): https://screenshots.phishdestroy.io/us/01a164b6-9528-75de-8aae-b7293e8084ed.png
URLScan capture report: https://urlscan.io/result/01a164b6-9528-75de-8aae-b7293e8084ed/
URLScan screenshot (2026-10-23T14:58:35Z): https://screenshots.phishdestroy.io/us/01a16945-15f6-731b-8279-3886b23bc755.png
URLScan capture report: https://urlscan.io/result/01a16945-15f6-731b-8279-3886b23bc755/
VirusTotal report: https://www.virustotal.com/gui/domain/goge.win
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=goge.win
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 15:24:32 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16943-28f9-7347-921a-842842a76460.png
  Captured: 2026-10-23 14:58:12 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a164b6-9528-75de-8aae-b7293e8084ed.png
  Captured: 2026-10-23 14:46:30 UTC
  Source report: https://urlscan.io/result/01a16943-28f9-7347-921a-842842a76460/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b779ffb5-d15d-4728-87fd-651762d31405.png
  Captured: 2026-10-23 14:50:39 UTC
  Source report: https://radar.cloudflare.com/scan/b779ffb5-d15d-4728-87fd-651762d31405
  SHA-256: 242b290c4ee9e1eefc85f4a60a344832d2d03a50011dee5d4b70ca7b2b1a2eda
- URLQuery: https://screenshots.phishdestroy.io/uq/ac504fff-e2a3-4193-b557-df0c309e2665.png
  Source report: https://urlquery.net/report/ac504fff-e2a3-4193-b557-df0c309e2665
  SHA-256: c2e79a33091aa4027df9b479f2504f3e281280b3554c5029c27579a975938177
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a164b6-9528-75de-8aae-b7293e8084ed.png
  Captured: 2026-10-22 17:44:19 UTC
  Source report: https://urlscan.io/result/01a164b6-9528-75de-8aae-b7293e8084ed/
  SHA-256: a1c2780dd7d22ef0efe22db9a01aed4bf08d7c076538652210216c3f13aef70e
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16945-15f6-731b-8279-3886b23bc755.png
  Captured: 2026-10-23 14:58:35 UTC
  Source report: https://urlscan.io/result/01a16945-15f6-731b-8279-3886b23bc755/
  SHA-256: 3eeb1d39fe0ce39c8fc74015bb370980b9d59daa04080026ab39f3511951d054

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T15:23:42Z",
        "uuid": "01a16943-28f9-7347-921a-842842a76460",
        "scanned_at": "2026-10-23T14:56:18Z",
        "final_url": "https://goge.win/w/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://goge.win/",
                "from": "http://goge.win/",
                "status": 307
            },
            {
                "to": "https://goge.win/w",
                "from": "https://goge.win/",
                "status": 302
            },
            {
                "to": "http://goge.win/w/",
                "from": "https://goge.win/w",
                "status": 301
            },
            {
                "to": "https://goge.win/w/",
                "from": "http://goge.win/w/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "static.ads-twitter.com",
            "connect.facebook.net"
        ],
        "ips": [
            "146.75.120.157",
            "57.144.154.128",
            "188.114.96.3"
        ],
        "asns": [
            "54113",
            "32934",
            "13335"
        ],
        "countries": [
            "DE",
            "FR"
        ],
        "doc_hash": "5b6929a0cfac7f675151ee07dcb34ea272a49e581c08d25e576909fa96dd60f0",
        "script_hashes": [
            "1930228456f99ec3fb1912f148a63538c6fc7b91a76b3cf47b6eded8f57364c1",
            "a87677f28d0d640a628d81e90ec37a86c6674c1c656277318f17b14c9542d045",
            "ece772926ce274f6d31508d891ec5fe44697a6e67273a5c359b17a44dc3fa2bf",
            "82b916c2ff6e9ac8cdc115f596700aff44c67c4cb3fcae2c6dad80a6baab40fa",
            "bb2ba96a789f1f0c6144a6d6ddba4a09c139b4060a1c9e97af56538d29415c2d",
            "0d653de16d82ad5663b217d4f67165a5b6d771a51a38c219689792e8566c0eb8",
            "c9a61872f0519908e071b9a59fef73f722cfd24c6b3b2800b82a5d8edef6705a",
            "540bcd2a2f66fa3e3bd6688d3e6c21aaa9d04dc17dfcc8da6dfa563b774b5181",
            "72a69f0e2a72941e227d3f5cc3106141081d3d9cbb2219809561dc24d1fdf890",
            "eaea74d0499f8b1b2c36f7ecd1378cd10563b34045086447956d3acdcf770297"
        ],
        "globals": [
            "webpackChunk_N_E",
            "next",
            "__next_f",
            "addNotification",
            "setOpenL",
            "setOpenR",
            "landScroll",
            "fbq",
            "_fbq",
            "twq",
            "loadTtq",
            "twttr"
        ],
        "tls": {
            "san": [
                "*.goge.win",
                "goge.win"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "goge.win",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T17:30:06Z",
            "valid_from": "2026-10-21T17:30:07Z"
        },
        "domain_age_days": 294,
        "apex_age_days": 294,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 65,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "cryptoscam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Crypto Scam"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T14:51:53Z",
        "uuid": "b779ffb5-d15d-4728-87fd-651762d31405",
        "scanned_at": "2026-10-23T14:50:39Z",
        "final_url": "https://goge.win/w/",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://goge.win/",
                "status": 302
            },
            {
                "url": "https://goge.win/w",
                "status": 301
            },
            {
                "url": "http://goge.win/w/",
                "status": 307
            },
            {
                "url": "https://goge.win/w/",
                "status": 200
            }
        ],
        "dom_hash": "c006e9cbf37bed4f0e5ba05ee56f4385b5e5b52afb3c707fcdb9ce4847e2753f",
        "doc_hash": "c0e180f2368efdc4a24e203b5a8b0f912e29cfebdb29c3266c9302a005191af4",
        "domain_risks": [
            "Gambling",
            "Gaming",
            "Entertainment",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "goge.win",
                "type": "A",
                "value": "172.67.219.135"
            },
            {
                "name": "goge.win",
                "type": "A",
                "value": "104.21.38.55"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.219.135",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-01-02T00:47:42Z",
            "updated": "2026-03-03T00:47:45Z",
            "expires": "2027-01-02T00:47:42Z",
            "nameservers": [
                "fish.ns.cloudflare.com",
                "jerry.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T15:22:05Z",
        "analysis_at": "2026-10-23T07:06:09Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "created": "2026-01-02T00:00:00Z",
        "updated": "2026-02-27T00:00:00Z",
        "first_seen": "2026-01-04T16:06:06Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "fish.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "fish.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.38.55"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jerry.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.219.135"
            }
        ],
        "dns_at": "2026-10-23T07:16:00Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.goge.win",
                "goge.win"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6fd7f2caacc87ae8d808deaf37971416215",
            "sha256": "b968737cc5ae76032e6bc4f4fca9b9015209d04af60d94d66ac42c75e2e36b96",
            "subject": "goge.win",
            "valid_to": "2027-01-19T17:30:06Z",
            "valid_from": "2026-10-21T17:30:07Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-01-02T00:47:42Z",
                "last changed": "2026-02-27T10:02:58Z",
                "registration": "2026-01-02T00:47:42Z",
                "registrar expiration": "2027-01-02T00:47:42Z",
                "last update of RDAP database": "2026-10-21T16:53:37Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T14:52:17Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "goge.win"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "social_tags": {
            "title": "GOGE | Play at the best online casino based on Blockchain",
            "themeColor": "#4383FF",
            "description": "GOGE is an amazing world of exciting original games and licensed slots built on Blockchain technology with provably fair gaming.",
            "canonicalUrl": "https://goge/"
        },
        "trackers": {
            "requests": 61,
            "trackers": [
                {
                    "name": "Facebook",
                    "company": "Meta",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 1
                },
                {
                    "name": "X Advertising",
                    "company": "X Corp.",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 1
                },
                {
                    "name": "Facebook Connect",
                    "company": "Meta",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 302,
            "timings": {
                "dns": 15,
                "tls": 45,
                "wait": 58,
                "connect": 30,
                "download": 0
            },
            "response_ms": 148
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 39109,
            "co2_grams": 0.0014,
            "cleaner_than": 42
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.252",
                    "host": "fish.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.182",
                    "host": "jerry.ns.cloudflare.com"
                }
            ],
            "zone": "goge.win"
        },
        "location": {
            "ip": "188.114.97.3",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "goge.win"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "fish.ns.cloudflare.com",
                "jerry.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"fish.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418093021, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "188.114.97.3",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://goge.win",
                "/w",
                "http://goge.win/w/",
                "https://goge.win/w/"
            ],
            "count": 3
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "React",
                "Next.js",
                "Twitter Ads",
                "Facebook Pixel",
                "core-js",
                "Priority Hints",
                "Webpack"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-01-02T00:47:42Z",
            "updated": "2026-03-03T00:47:45Z",
            "expires": "2027-01-02T00:47:42Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "jerry.ns.cloudflare.com",
                "fish.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "x-powered-by": "Next.js"
            }
        }
    }
}
```