goto[.]now

This domain is flagged by 12 out of 95 security vendors on VirusTotal and appears in 27 AlienVault OTX pulses. It carries a Gridinsoft trust score of 1 out of 100 and is listed on 2 security blocklists. The domain remains active with an HTTP 200 response and presents the page title Free URL Shortener - GoTo.now. Infrastructure analysis reveals registration through 101domain GRS Limited on September 30 2024 along with nameservers mitch.ns.cloudflare.com and sima.ns.cloudflare.com. The domain resolves to IP address 172.67.188.40 located in CA and uses an SSL certificate issued by Google Trust Services under the WE1 profile. An MX record points to mail.goto.now at priority 10. Multiple blocks are recorded from PhishDestroy and CryptoFirewall. Analysis indicates the domain functions as a URL shortener interface while maintaining high risk classification for generic phishing activity. Defenders should note the exact vendor detection count and pulse appearances as primary indicators rather than relying solely on blocklist presence. The creation date of September 30 2024 places the domain registration well before the current report date of July 12 2026. No direct evidence confirms specific brand impersonation beyond the observed page title and URL shortener presentation. Uncertainty remains regarding the exact payload delivered through shortened links hosted on this infrastructure. Defenders are advised to block the domain and its IP 172.67.188.40 at network perimeters and to monitor for mail traffic involving mail.goto.now. Continued observation of VirusTotal detections and OTX pulse updates is recommended to track any changes in vendor consensus. The combination of low trust score active status and multiple external blocks supports treating all traffic to this domain as high risk until further evidence emerges.