goface[.]shop

On July 23, 2026 the domain goface.shop was observed offline but retains a set of infrastructure artifacts that justify a high‑risk classification as a generic phishing site targeting e‑commerce users. The domain is registered through GoDaddy.com LLC and resolves to the Cloudflare‑owned address 104.21.24.69, which is located in Canada. Cloudflare services are evident from the presence of HSTS, HTTP/3 support and the authoritative nameservers lilith.ns.cloudflare.com and vicente.ns.cloudflare.com. The site presented a 404 Not Found page title at the time of capture, indicating that any expected landing page is no longer accessible.

SSL termination is provided by a Let’s Encrypt certificate (issuer E7), confirming the use of a valid TLS certificate despite the malicious intent. Reputation services uniformly flag the domain as unsafe: Gridinsoft assigns a trust score of 0 / 100, Scamadviser a score of 1 / 100, and Google Safe Browsing flags the URL for social‑engineering content. VirusTotal analysis shows that 10 of 94 security vendors have reported the domain as malicious, and the domain appears on one external security blocklist as well as being blocked by PhishDestroy. The combined evidence points to an e‑commerce phishing campaign, likely using the domain to lure victims into submitting payment or personal information, although the exact phishing kit or credential‑harvesting page has not been captured.

The offline status suggests the operators have either taken down the site or are rotating infrastructure, but the underlying hosting configuration remains reusable for future campaigns. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds with the observed indicators, and monitor the associated IP address and Cloudflare nameservers for any re‑activation.