# PhishDestroy domain threat record: vipaccess-gokite-ai.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/vipaccess-gokite-ai.com/
Machine-readable companion: https://phishdestroy.io/domain/vipaccess-gokite-ai.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 21:24:18 UTC
- Last availability or vendor check: 2026-10-27 23:00:26 UTC
- Stored record updated: 2026-10-27 23:54:44 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 403
- Registration date in stored WHOIS data: 2026-10-23 19:50:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16ac2-b4b3-76ea-84d2-8ca15dc06529/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/vipaccess-gokite-ai.com
- Certificate Transparency search: https://crt.sh/?q=%25.vipaccess-gokite-ai.com
- Web Archive lookup: https://web.archive.org/web/*/https://vipaccess-gokite-ai.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies vipaccess-gokite-ai.com as an Airdrop Scam. The recorded page title was “KITE Airdrop”. The domain was first seen by PhishDestroy on 2026-10-27, when the server returned HTTP 403 and presented a Cloudflare challenge that prevented content analysis.

How the scam works
Fake airdrop pages promise free tokens and typically ask visitors to submit a cryptocurrency wallet address, private keys, or to approve a token transfer. Granting such approvals can let an attacker move or drain the victim’s assets, while disclosed keys enable full control of the wallet.

Evidence
VirusTotal scanned the domain on 2026-10-28 and reported zero detections from 92 engines. Google Safe Browsing checked on 2026-10-28 and did not flag the site. urlscan.io captured the site on 2026-10-23, recorded a 403 response, a 307 self‑redirect, and its engine analysis marked the URL as malicious with a score of 80, though the overall verdict was non‑malicious. Spamhaus DBL listed the domain as phishing on 2026-10-28. OTX recorded three pulses mentioning the domain as of 2026-10-28. PhishDestroy’s internal blocklist includes the domain as of 2026-10-28.

Infrastructure
The domain was registered on 2026-10-23 with NICENIC INTERNATIONAL GROUP CO., LIMITED, set to expire on 2027-10-23 and carrying client‑delete‑prohibited and client‑transfer‑prohibited status. DNS records observed on 2026-10-27 listed Cloudflare A and AAAA addresses (e.g., 188.114.97.1, 104.21.1.196) and the network was identified as CloudFLARENET‑EU in GB. The TLS certificate observed was issued by Let’s Encrypt / YE2, valid from 2026-10-23 to 2027-01-21, and covered vipaccess-gokite-ai.com and *.vipaccess-gokite-ai.com.

What to do
Do not enter wallet addresses, private keys, or approve any token transfers on this site; if credentials were submitted, revoke any approvals and create a new wallet. Change passwords for any accounts that may have reused credentials. Defenders should block the exact domain, monitor outbound connections to its recorded IPs, and apply standard Cloudflare threat‑handling procedures.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16ac2-b4b3-76ea-84d2-8ca15dc06529/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8ab3a30a-b3ee-46af-baf1-f4de2d59eba1
Stored capture screenshot: https://urlscan.io/screenshots/01a16ac2-b4b3-76ea-84d2-8ca15dc06529.png
Cloudflare Radar screenshot (2026-10-27T21:32:47Z): https://screenshots.phishdestroy.io/cf/8ab3a30a-b3ee-46af-baf1-f4de2d59eba1.png
VirusTotal report: https://www.virustotal.com/gui/domain/vipaccess-gokite-ai.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=vipaccess-gokite-ai.com
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 23:54:24 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16ac2-b4b3-76ea-84d2-8ca15dc06529.png
  Captured: 2026-10-27 21:24:18 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16ac2-b4b3-76ea-84d2-8ca15dc06529.png
  Source report: https://urlscan.io/result/01a16ac2-b4b3-76ea-84d2-8ca15dc06529/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8ab3a30a-b3ee-46af-baf1-f4de2d59eba1.png
  Captured: 2026-10-27 21:32:47 UTC
  Source report: https://radar.cloudflare.com/scan/8ab3a30a-b3ee-46af-baf1-f4de2d59eba1
  SHA-256: 53292f39aa18cc5dbf5269f2350ccb0d3fad0ede5a351770547cac473fe2adbb

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T21:34:21Z",
        "uuid": "01a16ac2-b4b3-76ea-84d2-8ca15dc06529",
        "scanned_at": "2026-10-23T21:55:17Z",
        "final_url": "https://vipaccess-gokite-ai.com/",
        "status": 403,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://vipaccess-gokite-ai.com/",
                "from": "https://vipaccess-gokite-ai.com/",
                "status": 307
            }
        ],
        "ip": "172.67.129.223",
        "domains": [
            "challenges.cloudflare.com"
        ],
        "ips": [
            "104.18.95.41",
            "104.18.94.41",
            "172.67.129.223"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "c8ab6df5bb5c61901be2d9ebc533e6e859307a42e7294d07de2a9aee19f97ec2",
        "script_hashes": [
            "5c173f6742a0985a45e672ebf525b5386cb0ef903a3f118237311ec071c54f9a",
            "0094d81dfd7189665646fc80a5c9cf4d0c472bb719824e0d465bd6d4a7aa9da7"
        ],
        "globals": [
            "_cf_chl_opt",
            "AGRfA7",
            "qrht8",
            "LeviO5",
            "qpPe1",
            "atAFr0",
            "SABtz7",
            "FIac3",
            "RpzJz6",
            "QSqpx9",
            "ueZh9",
            "FBBK4",
            "ZliED2",
            "HKul9",
            "NmGWd6",
            "vUAjb0",
            "zCGb4",
            "runProgram",
            "THirw9",
            "IXEYu6",
            "nOLY0",
            "DraY9",
            "vyix0",
            "uEeN6",
            "nTlR0",
            "AwUcP3",
            "MkvrI5",
            "MpSwI7",
            "xrbo0",
            "vMhC1",
            "angular",
            "vvfHL3",
            "lffN9",
            "dSvRK1",
            "turnstile",
            "QBEM0",
            "AgLL2",
            "wEyW4",
            "THSr2"
        ],
        "cookies": [
            "cf_clearance",
            "cf_chl_rc_ni"
        ],
        "tls": {
            "san": [
                "*.vipaccess-gokite-ai.com",
                "vipaccess-gokite-ai.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "vipaccess-gokite-ai.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-21T20:55:46Z",
            "valid_from": "2026-10-23T20:55:47Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 19,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 80,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "default-src 'none'; script-src 'nonce-f5b1Gamy0u1I3iLzLn99Lk' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.clou",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin",
            "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s",
            "cross-origin-opener-policy": "same-origin",
            "cross-origin-resource-policy": "same-origin",
            "cross-origin-embedder-policy": "require-corp"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T21:34:22Z",
        "uuid": "8ab3a30a-b3ee-46af-baf1-f4de2d59eba1",
        "scanned_at": "2026-10-27T21:32:47Z",
        "final_url": "https://vipaccess-gokite-ai.com/",
        "status": 403,
        "history": [
            {
                "url": "https://vipaccess-gokite-ai.com/",
                "status": 403
            }
        ],
        "dom_hash": "09471bf8e29d5571159827bc83d881c38e2f56d8a5b71911b3689b846bb80841",
        "doc_hash": "6fd3d5d7e453c0ca7ad0bf5d3511049f09ad0507760fe11b4773ff52780e7521",
        "domain_risks": [
            "New Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "vipaccess-gokite-ai.com",
                "type": "A",
                "value": "104.21.1.196"
            },
            {
                "name": "vipaccess-gokite-ai.com",
                "type": "A",
                "value": "172.67.129.223"
            },
            {
                "name": "vipaccess-gokite-ai.com",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:81df"
            },
            {
                "name": "vipaccess-gokite-ai.com",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:1c4"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.3",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-23T21:50:18Z",
            "updated": "2026-10-23T21:50:57Z",
            "expires": "2027-10-23T21:50:18Z",
            "nameservers": [
                "milan.ns.cloudflare.com",
                "teresa.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T23:50:36Z",
        "analysis_at": "2026-10-24T09:34:12Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-23T21:50:18Z",
        "expires": "2027-10-23T21:50:18Z",
        "updated": "2026-10-23T21:50:57Z",
        "first_seen": "2026-10-23T21:58:33Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.129.223"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "teresa.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "milan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:81df"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.1.196"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "milan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:1c4"
            }
        ],
        "dns_at": "2026-10-24T09:45:18Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.vipaccess-gokite-ai.com",
                "vipaccess-gokite-ai.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6efe16d69d9a7ef5c17c35a26161bcfced7",
            "sha256": "a5eb763121f6bf1c4820f8c43f70f3ebbcfe39e4a12c92b63276b1c672782cac",
            "subject": "vipaccess-gokite-ai.com",
            "valid_to": "2027-01-21T20:55:46Z",
            "valid_from": "2026-10-23T20:55:47Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-23T21:50:18Z",
            "updated": "2026-10-23T21:50:18Z",
            "expires": "2027-10-23T21:50:18Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "milan.ns.cloudflare.com",
                "teresa.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-23T21:50:18Z",
                "registration": "2026-10-23T21:50:18Z",
                "registrar expiration": "2027-10-23T21:50:18Z",
                "last update of RDAP database": "2026-10-23T21:50:18Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T21:34:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "vipaccess-gokite-ai.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.21",
                    "host": "milan.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.38.216",
                    "host": "teresa.ns.cloudflare.com"
                }
            ],
            "zone": "vipaccess-gokite-ai.com"
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "vipaccess-gokite-ai.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "milan.ns.cloudflare.com",
                "teresa.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"milan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418604764, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-23T21:50:18Z",
            "updated": "2026-10-23T21:50:57Z",
            "expires": "2027-10-23T21:50:18Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "milan.ns.cloudflare.com",
                "teresa.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "default-src 'none'; script-src 'nonce-ufwAARVQxb5gajf5tiUbwt' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin",
                "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*",
                "cross-origin-opener-policy": "same-origin",
                "cross-origin-resource-policy": "same-origin",
                "cross-origin-embedder-policy": "require-corp"
            }
        }
    }
}
```