v3-gho[.]top

As of July 25, 2026, the domain v3-gho.top is flagged as a brand impersonation threat targeting x.com. The domain is currently offline, which may indicate that it has been taken down or is not actively being used. Infrastructure analysis reveals that the domain resolves to an IP address in the United States (104.21.22.229, AS13335 Cloudflare, Inc.), suggesting the use of Cloudflare services for hosting and DNS management. The domain is registered through NiceNIC International Group Co., Limited, and the SSL certificate is issued by Google Trust Services, which could be a sign of an attempt to appear legitimate to unsuspecting users.

However, the presence of the SSL certificate does not guarantee the site's safety, especially when the domain is associated with brand impersonation. The domain appears on one security blocklist and is blocked by PhishDestroy, indicating that it has been identified as a potential threat. The page title 'Welcome to nginx!' suggests that the site was displaying a default web server page at the time of analysis, which could be due to the domain being recently taken offline or not fully configured.

Given the elevated risk level and the specific targeting of x.com, defenders should remain vigilant and thoroughly verify any communications or links associated with this domain. It is recommended to monitor for any signs of reactivation and to ensure that end-users are aware of the potential risks associated with brand impersonation attacks. Additional analysis may be required if the domain becomes active again to confirm the nature of the threat.