globalhrfinbk[.]org

Analysis of globalhrfinbk.org shows a high‑risk, active phishing infrastructure targeting entities identified as Global Heritage Financial Bank. The site returned HTTP 200 and presents the page title "Global Heritage Financial Bank - Dedicated to innovating, simplifying, and humanizing digital banking," indicating a direct brand impersonation. The domain was registered on 2025‑11‑17 through TuringSign Inc. d/b/a Cosmotown and resolves to IP 163.61.188.7, which is geolocated to the United States (MIT). The server uses a Let’s Encrypt R12 certificate, providing only generic TLS encryption without any brand‑specific validation. Threat intelligence flags the domain on one security blocklist and notes a Gridinsoft trust score of 1 out of 100, reinforcing its malicious nature. PhishDestroy has already blocked the domain, and VirusTotal reports 16 of 91 scanners flagging it as malicious, corroborating the phishing classification. Given the high risk rating and active status, defenders should immediately add globalhrfinbk.org and its resolving IP to blocklists across perimeter and endpoint controls, monitor DNS queries for the domain, and consider sinkholing the IP address to disrupt traffic. Continuous telemetry should be collected to detect any credential harvesting attempts or credential reuse associated with the impersonated bank, and security teams should update phishing detection signatures to include the observed page title and TLS fingerprint.