gobexa[.]com

PhishDestroy identifies gobexa.com as an active generic phishing domain registered on April 03, 2026, with a Let's Encrypt SSL certificate. This domain is currently under investigation for impersonating legitimate financial services (payment processors) to harvest user credentials and cryptocurrency. While no specific brand or drainer kit payload has been confirmed in available telemetry, the absence of VirusTotal detections (16/95) suggests evasion tactics or a newly deployed threat actor infrastructure. Domain registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, and hosting on IP 188.114.96.3—shared with known malicious campaigns—further corroborates its malicious intent. Domain analysis reveals critical technical indicators: a 16/95 VirusTotal detection ratio, registration via NICENIC INTERNATIONAL GROUP CO., LIMITED, resolution to IP 188.114.96.3, and a creation date of April 03, 2026. The domain employs a Let's Encrypt SSL certificate, likely to mislead users into believing it is legitimate. As of this report, no blocklist entries have been recorded in PhishDestroy’s systems, indicating its relative novelty. Threat actors commonly exploit newly registered domains with short lifespans to evade detection, making immediate scrutiny essential. The current status of gobexa.com is active and under investigation (Unique Seed: 19961f). Affected users should immediately block the domain at network and endpoint levels, avoid any form of interaction, and report credentials or cryptocurrency wallet exposures to relevant authorities. While the immediate risk remains high due to its recency and low detection rate, coordinated takedown efforts and sandbox analysis are underway. Remaining risk hinges on rapid containment; however, users are strongly advised to treat this domain as hostile until further forensic validation confirms its dissipation or transformation into benign infrastructure.