globalxcfd[.]com

Analysis of the domain globalxcfd.com indicates it is an active phishing site targeting users of contract-for-difference (CFD) brokerage services, as suggested by its page title 'Global X CFD – CFD broker'. The domain was registered on April 16, 2025, through Ultahost, Inc., and currently resolves to the IP address 104.21.43.249. Infrastructure analysis reveals the use of Cloudflare, which may obscure the origin server and complicate takedown efforts. Detected technologies include WordPress, MySQL, PHP, jQuery Migrate, jQuery, and HTTP/3, suggesting a standard web stack that could be vulnerable to known exploits if not properly maintained. The domain is flagged by multiple security sources, including 23 threat intelligence pulses on AlienVault OTX and appearances on two security blocklists. Detection engines such as PhishDestroy and BLP-Malware have blocked access to this domain, and four of 95 security vendors on VirusTotal have marked it as malicious. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. While the exact content and tactics of the phishing campaign remain unconfirmed due to the absence of direct page analysis, the domain's infrastructure, registration details, and detection history align with known phishing patterns. Defenders should treat this domain as an active threat and consider implementing network-level blocks for the IP 104.21.43.249 and domain globalxcfd.com. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional malicious infrastructure. Given the use of Cloudflare, additional scrutiny of SSL certificates and subdomains is recommended. The domain's continued activity as of July 12, 2026, indicates that mitigation efforts have not yet been successful, and proactive measures are warranted.