go[.]goufax[.]com

On 7 August 2026 the domain go.goufax.com was identified as part of an active generic phishing campaign with an elevated risk rating. VirusTotal reports that 12 of 91 scanned security vendors flag the domain as malicious, indicating a moderate consensus among scanners. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy mitigation service, demonstrating that at least one anti‑phishing provider has taken protective action. DNS resolution points to the IPv4 address 64.7.198.11, which constitutes the sole visible hosting artifact in the current intelligence set. No additional infrastructure such as ASN, hosting provider, or SSL certificate details are disclosed in the available data.

The limited detection footprint suggests that the campaign may be in an early deployment stage or that the operators are using a minimal infrastructure footprint to evade large‑scale attribution. Defenders should prioritize ingesting the domain into network‑level blocklists and configure DNS filtering to deny resolution of go.goufax.com. Correlation of the observed IP address with internal logs may reveal compromised endpoints or malicious outbound connections. Continuous monitoring of VirusTotal and other multi‑engine scanners is advised to capture any changes in detection rates, which could indicate payload evolution or broader distribution. Because the domain is flagged by PhishDestroy, integration with that service’s feed can provide automated mitigation.

Organizations that employ external email gateways should update phishing‑detection rules to include the domain and its associated IP. Given the elevated risk rating, threat‑hunting teams should also search for related command‑and‑control traffic patterns or credential‑stealing activity that could be linked to the same IP address. At present, the absence of publicly available registrar or creation‑date information limits the ability to attribute ownership or assess longevity.