goodswize[.]ai

PhishDestroy identifies goodswize.ai as an active credential theft domain masquerading as a legitimate service. The domain is part of a phishing campaign designed to harvest user credentials through deceptive login prompts, often mimicking well-known brands or service interfaces. Security analysts have classified this infrastructure as a low-profile yet high-risk entry point for account takeovers, particularly in sectors targeting crypto wallets, financial portals, or corporate login systems. The domain’s operational timeline suggests a recently activated campaign, with threat actors leveraging newly registered domains to evade early detection by security systems.

This domain was flagged with zero detections on VirusTotal out of 95 scanners, indicating it has not yet been widely recognized by security vendors. The domain resolves to IP 104.21.21.6 and is registered through GoDaddy.com, LLC, with an SSL certificate issued by Let’s Encrypt—both commonly exploited by threat actors to lend false legitimacy to phishing sites. The domain was created on April 28, 2026, which places its deployment within the last 48 hours, minimizing historical blocklist coverage and increasing the risk of successful user compromise.

If you have visited goodswize.ai or entered any credentials, assume your account has been compromised. Immediately change passwords associated with the site or service it impersonates. Enable multi-factor authentication (MFA) on all relevant accounts. Scan your device for malware using a reputable security tool. Report the domain to your IT team or security provider. Avoid interacting with this domain or any linked content until further notice from threat intelligence sources.