globalancefinance[.]com

Analysis of globalancefinance.com shows that the domain was registered on February 21, 2026 through Cosmotown, Inc. The authoritative name servers ns115.my-control-panel.com and ns116.my-control-panel.com resolve the zone to the IP address 163.61.188.5, which belongs to AS153568 NEW DHAKA HARDWARE located in the United States. The host presents a Let’s Encrypt E7 certificate and serves content over HTTP/3 using LiteSpeed, Bootstrap, jQuery and SweetAlert libraries. The sole MX record points to mail.globalancefinance.com with priority 10, and the page title returned from the site is "Banking, Credit Cards, Mortgages," indicating an attempt to lure victims interested in financial services. Multiple security products have flagged the domain. Google Safe Browsing classifies it as social engineering, and PhishDestroy has added it to its blocklist.

VirusTotal analysis shows that 12 of 95 scanners reported the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one additional security blocklist. The current operational status is offline, which suggests the phishing infrastructure has been taken down or is no longer serving content. Despite the offline status, the observed indicators—recent creation, dedicated hosting, financial‑themed page title, low trust score, and multiple vendor detections—are consistent with a generic phishing campaign targeting banking credentials.

Defenders should continue to block the resolved IP 163.61.188.5, add the domain and its name servers to network deny lists, and monitor for any re‑registration or similar domains using the same registrar or hosting ASN. Additional investigation of the MX host mail.globalancefinance.com may reveal related command‑and‑control activity. Because the site is no longer reachable, passive DNS and historical web‑archive data can be leveraged to extract any previously served phishing pages for further attribution.