gohumanfirst[.]org

On July 15 2026 the domain gohumanfirst.org was registered through Fewmoretaps OU d/b/a Trustname.com. The registration record lists four authoritative nameservers: ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com. DNS resolution points to the IPv4 address 216.152.155.235, which remains active as of the report date (July 20 2026). The domain has been observed on a single security blocklist and is currently blocked by the PhishDestroy sinkhole. VirusTotal has processed the domain with scans from 95 AV engines, none of which reported a detection at the time of analysis. No public information about the site’s HTTP response, SSL certificate, or page title is available, and the content has not been captured in open‑source repositories such as OTX. The lack of detections in VirusTotal does not imply benign intent; the recent creation date, the use of a trust‑named registrar, and the association with a known sinkhole suggest the domain is being leveraged for a phishing campaign. Analysts should continue to monitor DNS queries for the domain, enforce network‑level blocklists that include the listed IP address, and add gohumanfirst.org to internal phishing‑URL filters. Observers should also watch for related domains that share the same nameserver set or resolve to the same IP, as these may indicate a broader infrastructure. Until further forensic evidence is gathered, the domain should be treated as malicious and excluded from user‑facing services.