globallegalclaims[.]org

globallegalclaims.org is currently listed as an active crypto‑drainer campaign with a high risk rating. The domain was registered on February 10 2026 through Ultahost, Inc. and is hosted on an Apache HTTP Server front‑end. It resolves to the IPv4 address 109.176.30.207, which is geolocated to the United Kingdom and attributed to Datacamp Limited. The site presents a valid Let’s Encrypt TLS certificate and uses Cloudflare nameservers izabella.ns.cloudflare.com and ken.ns.cloudflare.com. Observations from multiple threat intel sources indicate that the domain has been blocked by the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal scans have flagged the domain by 14 of 95 security vendors, and Gridinsoft assigns it a trust score of 0 out of 100. An HTTP request to the root URL returns a 200 status code, confirming that the web service is publicly reachable. The published MX records list a primary mail exchanger at mail.globallegalclaims.org with priority 0, followed by an additional host with priority 10; however, the second host entry is incomplete, limiting insight into the full mail infrastructure. No further information on associated command‑and‑control servers or payload delivery mechanisms has been disclosed, leaving the broader operational picture partially unknown. Defenders should treat traffic to both the domain and its resolved IP as malicious. Immediate mitigation steps include adding the domain and IP address to network deny lists, enforcing TLS inspection to capture encrypted payloads, and monitoring for any DNS queries to the identified Cloudflare nameservers. Continuous re‑evaluation is advised, as changes to the hosting configuration or additional blocklist listings could alter the threat landscape.