gooddayhouse[.]com

gooddayhouse.com was observed serving a web page with the title “World news – e-enable synergistic initiatives”. The site returns HTTP 200 and hosts an SSL certificate issued by the R3 intermediate, indicating a Let’s Encrypt chain. The domain was registered on February 21, 2026 through Name Nelly, LLC and uses the afternic.com nameservers ns1.afternic.com and ns2.afternic.com, with an additional verification‑d3jclucsp89ganyqbydeny.ns entry. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. AlienVault OTX references the domain in one threat‑intelligence pulse. The domain resolves to the IPv4 address 5.42.65.101, which belongs to AS39493 (CJSC Kolomna‑Sviaz TV) and is geolocated in Russia. No additional hosting infrastructure was identified beyond this single address. The SSL certificate chain is valid, and VirusTotal currently reports zero detections out of 95 scanners, indicating that the payload, if any, has not yet been captured by automated sandboxes. Based on the page title and the generic nature of the content, the site appears to be a credential‑harvesting front that mimics a news portal, a common pattern for generic phishing campaigns. The low trust score, recent creation date, and presence on a blocklist suggest deliberate malicious intent. However, no definitive evidence of credential collection, malware delivery, or specific targeted brand has been uncovered, leaving the exact phishing vector uncertain. Defenders should proactively block gooddayhouse.com and its resolving IP 5.42.65.101 at perimeter and endpoint controls. Monitoring for DNS queries to the domain and for HTTP traffic matching the observed page title can help detect attempted accesses. Adding the domain to internal blocklists and sharing the indicators with threat‑intel feeds will reduce exposure. Continuous re‑evaluation is advised, as the threat remains active and under investigation.