gh0p[.]biz

Analysis of the domain gh0p.biz indicates active phishing infrastructure targeting users through a fraudulent security-themed portal. Registered on July 18, 2024, via NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to the IP address 217.114.42.74, hosted by DDoS-Guard LLC in Russia. The nameserver configuration—ns1.ddos-guard.net through ns5.ddos-guard.net—aligns with a known bulletproof hosting pattern frequently exploited for malicious campaigns. The site presents itself under the page title 'GH0P Security,' though no specific brand affiliation or targeted service has been confirmed through available metadata. Infrastructure review reveals the use of Bootstrap and jQuery frameworks, alongside DDoS-Guard’s protective proxy, which may obscure backend server details. The domain’s SSL certificate, issued by Let’s Encrypt (R13), remains valid, enabling encrypted connections that lend superficial legitimacy to the phishing attempt. MX records point to mail.gh0p.biz with a priority of 10, suggesting potential email-based attack vectors, though no direct evidence of email abuse has been observed in this assessment. Detection data remains limited: as of July 12, 2026, four of ninety-one security vendors on VirusTotal have flagged the domain, while a single blocklist entry exists. The domain’s Gridinsoft trust score of 0/100 further corroborates its high-risk classification. Defenders should treat gh0p.biz as an active threat, particularly given its continued operational status and association with a hosting provider historically linked to malicious activity. Network-level blocking of 217.114.42.74 and monitoring of related subdomains (e.g., mail.gh0p.biz) are recommended mitigation steps. No evidence currently links this domain to a specific phishing kit or targeted brand beyond the 'GH0P Security' page title, leaving the exact nature of the scam uncertain pending further analysis.