globalcrest[.]net

The domain globalcrest.net was registered on March 14, 2026 through HOSTINGER operations, UAB and is currently resolved to the IPv4 address 2.57.91.180. Authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, indicating the domain is parked on a generic DNS service. VirusTotal reports three positive detections out of ninety‑one scanned security vendors, confirming that multiple anti‑malware engines have flagged the domain as malicious. The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing its classification as a high‑risk phishing infrastructure.

Risk level is marked high and the campaign remains active as of the report date, July 27, 2026. Analysis of the available telemetry shows a typical pattern of newly created, parked domains that are quickly leveraged for credential‑harvesting campaigns. The limited detection footprint—three vendor flags and a single blocklist entry—suggests the site may be in early stages of distribution, or that detection mechanisms have not fully propagated. The use of a reputable hosting provider (HOSTINGER) and a common parking nameserver set does not mitigate the observed malicious indicators.

Defenders should add 2.57.91.180 and the domain globalcrest.net to inbound and outbound filtering rules, ensure that any URL filtering services reference the PhishDestroy blocklist, and monitor for any further escalation in detection counts. Continuous re‑scanning on VirusTotal or similar multi‑engine platforms is recommended to capture additional vendor judgments as the campaign evolves. Organizations should also consider notifying upstream DNS providers to enforce sink‑holing or takedown actions if the domain is observed targeting internal users.