globalvisioncenter[.]org

Analysis of the domain globalvisioncenter.org, created on February 25 2026 and currently taken offline, shows multiple indicators of malicious use. The site resolves to the IPv4 address 185.21.14.111, which is geolocated to the Netherlands and assigned to AS216071 SERVERS TECH FZCO. Registration was performed through Dynadot LLC, and the authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net. The page title returned by the site, "EU • Стек карточек," is presented in Cyrillic script and provides no direct evidence of the content hosted.

No SSL certificate was observed, meaning the site offered only unencrypted HTTP connections. VirusTotal scanned the domain and reported that one out of ninety-three security vendors flagged it as malicious, suggesting at least one detection of phishing or related activity. The domain is listed on two independent blocklists and has been actively blocked by the PhishDestroy and ScamSniffer filtering services. These detections collectively support the classification of the domain as a generic phishing infrastructure.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as the page content has not been captured and no additional telemetry such as sandbox analysis or HTTP response details is available. Defenders are advised to continue blocking traffic to 185.21.14.111 and to add globalvisioncenter.org to internal URL filtering rules. Monitoring for re‑registration or new IP resolution is recommended, as threat actors may attempt to resurrect the domain. Incident response teams should treat any residual logs referencing this domain as potentially compromised and consider user credential resets if exposure is suspected.