allianceglobal[.]com[.]tr

This domain, allianceglobal.com.tr, is actively flagged as a high-risk credential phishing site impersonating a global trade entity. Analysis indicates the domain was registered on May 15, 2026, through a Turkish registrar, with hosting infrastructure located in France. The site resolves to IP address 92.205.58.10, operated by Host Europe GmbH, and presents a page titled 'Alliance Global – Global Trade,' suggesting an attempt to mimic legitimate business services in the import-export sector. Infrastructure review reveals the domain uses Let’s Encrypt SSL certificates issued under the R13 intermediate, a common choice for both legitimate and malicious sites due to its free and automated nature. MX records point to mx-in05.natrohost.com with a secondary priority of 1000, indicating potential email functionality that could be leveraged for follow-up phishing or business email compromise attempts. The domain appears on one security blocklist and is detected by six out of ninety-five security vendors on a widely used scanning platform, reflecting moderate but not universal recognition of its malicious nature. While the domain’s creation date is recent, the use of a country-code top-level domain (ccTLD) and hosting in a European data center may reduce initial suspicion among some automated detection systems. The site remains operational as of July 12, 2026, returning a 200 HTTP status, which confirms active hosting. Defenders should prioritize blocking this domain at the DNS and web proxy layers, particularly in organizations involved in international trade or logistics. Email filtering systems should inspect inbound messages containing links to this domain or its associated IP, as it may be used in targeted campaigns. Given the domain’s presence in a single threat intelligence pulse and its low trust score, further monitoring is recommended to assess whether it becomes more widely recognized as malicious over time.