goat-drop[.]top

Analysis of the domain goat-drop.top indicates that the infrastructure was provisioned on 9 December 2025 through the registrar PDR Ltd. d/b/a PublicDomainRegistry.com. The domain is delegated to Cloudflare name servers (james.ns.cloudflare.com and meiling.ns.cloudflare.com) and resolves to the IP address 198.18.1.251. No TLS certificate is presented for the host, implying that any client connection would be made over unencrypted HTTP. Threat intelligence feeds have placed the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service.

The Gridinsoft trust scoring system assigns a rating of 0 out of 100, the lowest possible confidence level. VirusTotal reports that fifteen of ninety‑five scanning engines flag the domain as malicious, reinforcing the suspicion that the site is being used for fraudulent activity. The current operational status is recorded as offline, suggesting that the site is no longer reachable at the time of this assessment. The observable data points confirm that goat‑drop.top is part of a generic phishing campaign, although the specific brand or service being impersonated has not been disclosed in the available metadata.

Because the site lacks a certificate and no HTTP response details or page titles have been captured, the exact content and attack vector remain unknown. Defenders should continue to block traffic to the domain at the network perimeter, update DNS filtering policies, and monitor the associated IP address for any re‑activation. Organizations employing web reputation services should ensure that the domain is listed in their blocklists, and security teams should audit logs for any historic connections to 198.18.1.251 that may indicate exposure before the takedown. Ongoing vigilance is advised, as the underlying hosting infrastructure could be repurposed for future phishing operations.