Analyse phishing et sécurité de glolizgp.com

This domain, glolizgp.com, was registered on April 27 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative name servers are ns3.my‑ndns.com and ns4.my‑ndns.com, and DNS resolution points to the IPv4 address 193.24.123.205, which is allocated to a Russian entity identified as Prospero OOO. The site is protected by a Let’s Encrypt certificate (issuer E8), indicating that TLS was in place at the time of observation. Reputation data show a Gridinsoft trust score of 0 out of 100, and the domain appears on three public blocklists. Specifically, it has been listed by PhishDestroy, MetaMask, and SEAL, confirming that multiple anti‑phishing feeds have flagged it.

VirusTotal analysis recorded five detections out of ninety‑one scanned scanners, reinforcing the suspicion of malicious activity. The current operational status is “offline,” meaning no HTTP response was observed during the latest check, but the underlying infrastructure remains resolvable and active. No public page title or content snapshot has been released, so the exact phishing lure employed cannot be confirmed. Likewise, no additional indicators such as malware payload hashes or command‑and‑control endpoints have been disclosed. Given the observed evidence—recent registration, low trust score, presence on multiple phishing blocklists, a modest number of VirusTotal detections, and association with a Russian hosting provider—defenders should treat glolizgp.com as a high‑confidence phishing indicator.

Network‑level controls ought to block connections to 193.24.123.205 and to the domain itself. Email gateways should add the domain to deny lists, and web‑proxy policies should enforce blocklist entries from PhishDestroy, MetaMask, and SEAL. Continuous monitoring of the IP address and name‑server records is recommended to detect any re‑activation. Until further forensic detail becomes available, the domain should be assumed malicious and excluded from trusted traffic.