globalrichhelp[.]com

globalrichhelp.com is an active generic phishing domain currently under investigation by Threat Intelligence teams after emerging on August 20, 2025. This domain masquerades as a financial assistance portal, deploying deception to trick users into entering sensitive personal or payment data. The payload is not yet widely detected, with VirusTotal showing 2/95 detections as of current data. The campaign is classified as active and requires immediate scrutiny due to high potential for fraudulent credential harvesting or financial theft. This domain was registered through GoDaddy.com, LLC, resolving to IP address 103.180.120.198. The domain was created on August 20, 2025, and uses a Let’s Encrypt SSL certificate to appear legitimate. As of the time of writing, there are no known entries on public blocklists such as PhishTank or OpenPhish, and trust scores remain uncalculated due to its recent creation. The low detection rate on VirusTotal suggests it is either in early deployment or using evasion techniques to bypass initial scans. To mitigate risk, users should avoid accessing globalrichhelp.com or any related URLs. Organizations are advised to block both the domain and the associated IP 103.180.120.198 at the network perimeter. If exposure has occurred, users should immediately change passwords, enable two-factor authentication, and monitor financial accounts for suspicious activity. Security teams should flag and investigate any internal connections to this domain for signs of compromise. Always verify financial service portals directly via official channels and report suspicious domains to relevant threat intelligence platforms or CERT teams.