goodhook[.]box

The domain goodhook.box has been identified as a generic phishing site. It does not impersonate any specific brand or utilize a drainer kit, but it poses an elevated risk to users who may have interacted with it. As of the latest assessment, goodhook.box is offline and no longer serving content, reducing its immediate threat. Individuals searching for information about goodhook.box and its safety should be aware that this domain has been linked to phishing scams and is not considered safe.

Technical analysis shows that goodhook.box was registered through NameSilo, LLC on April 29, 2025. The domain resolved to the IP address 154.211.89.4, located in Singapore (AS399077 Tcloudnet), and used nameservers ns1.3dns.box and ns2.3dns.box. The website was detected by 2 of 95 security vendors on VirusTotal, specifically alphaMountain.ai and SOCRadar, and appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. The Google Safe Browsing service has not flagged this domain. Technologies identified on the site included Vue.js, Nginx, HSTS, and HTTP/3. The observed page title was GOODHOOK.

Anyone who entered credentials or sensitive information on goodhook.box should immediately change affected passwords, enable two-factor authentication where possible, and monitor accounts for suspicious activity. It is advisable to report any related phishing attempts to relevant security authorities or organizations. Staying vigilant and using up-to-date security tools can help reduce the risk of falling victim to similar phishing scams in the future.