add[.]gosoter[.]xyz

The domain add.gosoter.xyz was registered on 24 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IPv6 address 2606:4700:3033::ac43:d311, which belongs to AS13335 operated by Cloudflare, Inc., and the host is located in the United States. The authoritative nameservers are leo.ns.cloudflare.com and phoenix.ns.cloudflare.com, indicating that the domain is using Cloudflare’s DNS service. No TLS certificate is presented; HTTP requests return a page whose title is “Just a moment…”, and the site has been taken offline as of the report date.

The domain is listed on a single security blocklist and is flagged by PhishDestroy. VirusTotal scans show that 2 of 93 security vendors have issued a detection for the domain, reinforcing the suspicion of malicious use. The limited detection footprint and the absence of a certificate suggest a short‑lived hosting pattern typical of credential‑harvesting campaigns. Analysis confirms the presence of a generic phishing infrastructure, but the specific payload, targeted brand, or victim profile has not been disclosed.

The lack of SSL, the generic page title, and the rapid takedown indicate that the site may have been used for a brief credential‑capture operation before being seized or abandoned. Defenders should continue to block the domain at perimeter filters, monitor for any residual traffic to the associated Cloudflare IP range, and consider adding the domain to internal blocklists. Additional scrutiny of logs for connections to 2606:4700:3033::ac43:d311 may reveal lingering attempts to contact the site. Because the domain is already offline, threat actors are unlikely to reuse this exact host, but the underlying registration pattern could be replicated, so vigilance on newly registered domains using Cloudflare’s infrastructure is advised.