cpanel[.]applyglobaldynamic[.]com

Analysis of cpanel.applyglobaldynamic.com indicates that the domain is currently active and returning HTTP 200 responses, which is consistent with an operational web service. The domain appears on a single security blocklist and has been specifically blocked by PhishDestroy, confirming its classification as a phishing infrastructure. Registration details show the domain was provisioned through Ultahost, Inc., using four authoritative name servers (ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, ns4.ultahost.com), suggesting the hosting environment is provided by the same provider.

VirusTotal scanning reports four out of ninety‑one antivirus and URL‑reputation engines flagging the domain, reinforcing the malicious assessment despite the majority of engines returning a clean verdict. The limited detection footprint—only one blocklist entry and a small subset of VirusTotal detections—means that broader threat‑intel feeds may not yet have incorporated the indicator, and additional context such as target brand, page title, or observed payload is not presently available. Consequently, defenders should treat the domain as high‑risk until further analysis confirms otherwise.

Recommended actions include adding the domain to outbound and inbound firewall deny lists, updating DNS sinkhole configurations, and monitoring for any related C2 or credential‑harvesting activity. Continuous re‑scanning on VirusTotal and periodic checks against emerging blocklists are advised to capture any changes in detection status. Because the domain resolves to a legitimate‑looking subdomain (cpanel...), it may be used to host credential‑collection pages that rely on the appearance of a control panel interface; therefore, any alerts involving attempted connections to this host should be investigated promptly.