globalcoinstrade[.]org

Analysis of globalcoinstrade.org indicates a high-risk phishing domain targeting cryptocurrency users. The domain was registered on August 20, 2024, through Atak Domain Bilgi Teknolojileri A.Ş., a registrar frequently associated with fraudulent infrastructure. As of July 27, 2026, the domain remains active and resolves to the IP address 51.68.132.247, hosted on an infrastructure previously linked to malicious activity. The domain's nameservers—ns1.sagaciousdns.com, ns2.sagaciousdns.com, ns3.sagaciousdns.com, and ns4.sagaciousdns.com—are part of a DNS cluster known for hosting phishing and scam operations, though no specific brand impersonation or phishing kit has been confirmed in available intelligence. Security vendor detections are limited but notable: four of ninety-one engines on VirusTotal flagged the domain as malicious, while PhishDestroy has explicitly blocked it.

The domain appears on at least one security blocklist, reinforcing its classification as a threat. No Safe Browsing or Open Threat Exchange (OTX) records were provided in the available data, leaving gaps in cross-platform visibility. The domain’s SSL certificate and HTTP response status were not analyzed in this assessment, and no page title or brand target has been confirmed, preventing attribution to a specific cryptocurrency platform or service. Defenders should treat this domain as an active threat.

Network-level blocking of the IP 51.68.132.247 and the associated nameservers is recommended to disrupt potential redirection chains. Organizations should monitor for connections to this domain, particularly in environments where cryptocurrency transactions or wallet interactions occur. Given the domain’s persistence since August 2024 and its presence on blocklists, it is likely part of a broader campaign rather than an isolated incident. Further investigation into the hosting provider and registrar may reveal additional linked infrastructure.