gov-mogcoin[.]xyz

The domain gov-mogcoin.xyz was registered through Dynadot LLC on 2025-12-05 and resolves to the Cloudflare IP address 188.114.97.3, which is announced by AS13335 (Cloudflare, Inc.) in the United States. The authoritative nameservers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate is presented for the host, and HTTP requests return an offline status, confirming that the site is currently taken down. Reputation scoring from Gridinsoft assigns a trust value of 0 out of 100, and the domain appears on a single security blocklist.

PhishDestroy has already listed the domain as malicious, and VirusTotal records show that 15 of 95 scanned scanners flagged the domain as suspicious. AlienVault’s Open Threat Exchange reports a single pulse referencing the domain, further corroborating its association with malicious activity. The available evidence points to a generic phishing campaign, although the specific brand or service being spoofed has not been disclosed in the collected metadata.

Analysts should continue to block the domain at network perimeter devices, update DNS sinkhole entries, and monitor any future re‑registration attempts. Because the site is hosted behind Cloudflare, any rapid changes to the underlying IP address could evade static blocks; therefore, dynamic threat‑intel feeds should be leveraged. Until additional content analysis becomes available, the domain should be treated as high‑risk for credential harvesting or monetary fraud.