verification-globaldollar[.]com

Analysis of verification-globaldollar.com shows a high‑risk, active phishing infrastructure. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution uses Cloudflare nameservers benedict.ns.cloudflare.com and desiree.ns.cloudflare.com. HTTP requests return a 301 redirect and the site presents an HSTS header, Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support. The SSL certificate is issued by Google Trust Services under the WE1 name, confirming a valid TLS endpoint. The page title returned is "about:privatebrowsing", indicating that the landing page content has not been captured or is deliberately obfuscated. Security telemetry assigns a Gridinsoft trust score of 0 / 100 and the domain appears on three independent blocklists. It has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report five of ninety‑three security vendors flagging the domain as malicious. Intelligence links the site to an Airdrop Scam phishing kit, a known commodity used to harvest credentials under the guise of cryptocurrency giveaways. While the exact phishing payload and victim interaction flow remain unverified, the convergence of low trust scores, multiple blocklist listings, a valid TLS certificate, and the association with a documented scam kit justifies a high‑severity rating. Defenders should immediately block resolution of verification-globaldollar.com, monitor outbound DNS queries for the associated Cloudflare IP, and consider adding the domain to email and web filtering policies. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.