gokiteapp[.]com

Analysis of gokiteapp.com indicates this domain was actively flagged as a phishing threat prior to being taken offline on July 25, 2026. The domain, registered on October 29, 2025, through Name SRS AB, exhibited multiple high-risk infrastructure characteristics. It resolved to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), a common choice for both legitimate services and malicious actors due to its proxy capabilities. The domain's nameservers—heidi.ns.cloudflare.com and jay.ns.cloudflare.com—further confirm Cloudflare's infrastructure usage, though this alone does not distinguish between benign and malicious intent. The domain's HTTP response included the page title 'Nur einen Moment…' (German for 'Just a moment…'), a generic waiting message often associated with Cloudflare's interstitial pages. However, this title has been observed in phishing campaigns where attackers exploit Cloudflare's proxy to mask the true destination or create a false sense of legitimacy.

No SSL certificate was detected, which is atypical for legitimate sites but not uncommon in hastily deployed phishing domains. The absence of encryption increases the risk of credential interception or redirection to unsecured malicious endpoints. Detection data reveals that gokiteapp.com was flagged by three security vendors on VirusTotal, though the specific nature of the threat (e.g., credential harvesting, malware distribution) is not detailed in available intelligence. The domain appeared on at least one security blocklist and was blocked by PhishDestroy, a specialized anti-phishing service. Gridinsoft assigned a trust score of 0/100, indicating a high-confidence malicious classification. At the time of this report, the domain is offline, which may reflect takedown efforts or the conclusion of a short-lived campaign.

Defenders should treat this domain as confirmed malicious based on its detection history, infrastructure, and blocklist presence.