ghl847[.]com

The domain ghl847.com is identified as a high-risk phishing domain and is currently offline. This domain does not impersonate a specific brand but poses a generic phishing threat to users. The domain's primary threat is the potential to steal sensitive information such as login credentials and financial data.

Analysis indicates that ghl847.com is flagged by 17 of 95 VirusTotal vendors, suggesting a significant level of suspicion among security experts. The domain is registered through GMO Internet Group, Inc. d/b/a Onamae.com and was created on April 22, 2026. It resolves to the IP address 188.114.97.3, which is located in California, USA, and is operated by CloudFlare, Inc. The domain appears on 3 security blocklists, further corroborating its malicious nature. The SSL certificate is issued by Let's Encrypt, with the identifier E7, which is a common practice for legitimate websites but can also be used by malicious actors to gain user trust.

Currently, the domain ghl847.com is offline. However, the infrastructure and registration details suggest that it was actively used for phishing attacks. Security teams are advised to monitor for any reactivation of the domain and to ensure that it remains blocked in network defenses. Users should be educated to avoid clicking on links from unknown sources and to verify the legitimacy of websites before entering any sensitive information.