goblinculture[.]com

Analysis of goblinculture.com reveals a newly registered domain (creation date June 01, 2026) that is currently active and hosted on IP address 2.24.198.130. The domain is registered through GoDaddy.com, LLC and uses the default GoDaddy nameservers ns17.domaincontrol.com and ns18.domaincontrol.com. Infrastructure checks show the domain appears on three independent security blocklists, specifically PhishDestroy, MetaMask, and SEAL, indicating that multiple threat intelligence feeds have identified it as malicious.

VirusTotal has processed the domain with 95 scanning engines, and none of those engines reported a detection at the time of analysis; this lack of detection does not constitute a safety assurance. No public evidence of SSL configuration, HTTP response codes, Safe Browsing verdicts, or page title information is available, leaving the exact content and attack vector unverified. The primary uncertainty lies in the absent content analysis and the absence of any observed victim reports, which prevents a full attribution of the phishing campaign’s target or payload.

Defenders should block the domain at network perimeter devices, update DNS filtering policies to include the listed blocklists, and monitor for any outbound traffic to the associated IP address. Continuous re‑scanning with sandbox and URL reputation services is recommended to capture any future changes in the domain’s behavior or content.