goosevpn[.]world

This domain, goosevpn.world, is identified as a generic phishing infrastructure impersonating a VPN service to harvest user credentials. Analysis indicates no direct association with known crypto drainer kits or brand-specific impersonation frameworks, but the domain follows patterns consistent with credential theft operations. The lack of legitimate service ties and the use of a newly registered domain suggest a deliberate attempt to deceive users seeking VPN access. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 147.45.44.133 and was registered on April 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by at least one threat intelligence feed prior to takedown. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to enforcement actions or voluntary suspension by the registrar. While this reduces immediate exposure, residual risk remains due to the domain's recent creation and prior malicious classification. Organizations are advised to monitor for re-registration or related infrastructure, particularly under the same registrar or IP range. Users should verify VPN service authenticity through official channels and avoid interacting with domains registered within the last 90 days for sensitive transactions.