a[.]gobookroom[.]com

PhishDestroy identifies a.gobookroom.com as a credential theft phishing domain actively impersonating legitimate services to harvest user credentials. This domain mimics the branding of popular platforms, luring victims into entering sensitive login information on fraudulent login pages. The threat actor behind this campaign leverages deceptive subdomains and convincing page layouts to increase the likelihood of successful credential capture. Historical intelligence suggests this infrastructure may be part of a broader campaign targeting enterprise and individual users alike.

Technical indicators confirm the malicious nature of a.gobookroom.com. VirusTotal analysis reveals a 21/95 detection ratio, with OpenPhish and PhishingArmy actively blocking access to the domain. The domain was registered through GoDaddy.com, LLC on October 26, 2025, and resolves to IP address 102.223.72.62. The SSL certificate, issued by TrustAsia Technologies, Inc., further obfuscates malicious activities by providing a veneer of legitimacy. Additionally, this domain appears on two security blocklists, reinforcing its elevated risk profile.

The current status of a.gobookroom.com remains active, with no evidence of takedown as of this report. Given the elevated risk level and active distribution, users are strongly advised to avoid interacting with this domain or any associated subdomains. Immediate mitigation steps include blocking the domain at the network and DNS levels, updating phishing blocklists, and educating users about the risks of credential theft campaigns. The remaining risk is high due to the domain’s recent creation, active distribution, and partial detection coverage, suggesting a need for heightened vigilance and proactive threat hunting.