goojoo[.]net

This domain, goojoo.net, is flagged as an active credential-phishing infrastructure operating since February 21, 2026. Infrastructure analysis reveals the domain is registered through Gabia, Inc. and resolves to the IP address 115.68.17.176, hosted on a South Korean network (SMILESERV). The domain's nameservers are ns.gabia.co.kr and ns1.gabia.co.kr, and it maintains an MX record pointing to gwmail.ktbizoffice.com with a priority of 10, suggesting potential email-based phishing or spoofing capabilities. The domain currently returns an HTTP 200 status, indicating an accessible web resource. Its SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites. While the page title is simply 'goojoo.net,' the domain is explicitly classified as a credential-phishing site in available threat intelligence. It appears on two security blocklists and is detected by at least two security vendors, though the specific nature of the phishing content has not been fully analyzed. Defenders should note that this domain remains active as of July 13, 2026, and is blocked by at least two security solutions. The registration date of February 2026 and continued accessibility suggest it is part of an ongoing campaign. Organizations are advised to monitor for connections to 115.68.17.176 or the domain itself, and to review email logs for references to gwmail.ktbizoffice.com, which may indicate related phishing attempts. Further analysis of the site's content and payloads is recommended to determine the exact targeting or brand impersonation, if any.