goatsosal[.]click

The domain goatsosal.click was observed on 23 July 2026 as an active brand‑impersonation campaign targeting the brand celer. Registration records show the domain was created on 21 February 2026 through Global Domain Group LLC. DNS resolution points to the IP address 172.67.219.25, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are julio.ns.cloudflare.com and sierra.ns.cloudflare.com, indicating that the infrastructure is fully proxied behind Cloudflare’s network and that the site is served over HTTP/3. TLS negotiation presents a certificate issued by Google Trust Services under the WE1 label, confirming the use of a valid SSL chain. An HTTP request returns status code 403, suggesting that the server is deliberately restricting access, a pattern often seen in phishing landing pages that require specific parameters.

The page title returned by the server is “1 new message”, which provides no further context about the malicious payload. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, effectively flagging the domain as malicious. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on one public blocklist. PhishDestroy has already listed the domain as blocked. VirusTotal analysis shows that 15 of 93 scanning engines have raised detections, reinforcing the malicious assessment.

Technologies identified include Cloudflare’s CDN and HTTP/3 support, which are commonly leveraged to hide the true origin of phishing infrastructure. No additional evidence such as page content or credential‑harvesting forms is currently available, so the precise victim‑interaction flow remains uncertain. Defenders should add goatsosal.click to blocklists at the DNS and firewall level, monitor outbound connections to the associated Cloudflare IP range, and apply URL filtering based on the Google Safe Browsing classification.