drnsglobal[.]org

Analysis of drnsglobal.org indicates a high‑risk, active phishing infrastructure. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to IP 206.168.149.10, which is announced by AS26042 (FiberState, LLC) in the United States. The site presents a valid HTTPS certificate issued by Let’s Encrypt (R12) and returns HTTP 200, but the page title is limited to “Problem loading page,” suggesting that the front‑end content is either deliberately minimal or currently unavailable for inspection. Technical fingerprints reveal a WordPress stack backed by MySQL and PHP, with client‑side libraries including Chart.js, LiteSpeed, Cloudflare, Lightbox, and jQuery Migrate. Nameservers are ns1.iaasdns.com and ns2.iaasdns.com, indicating reliance on a third‑party DNS provider.

Reputation checks show a Gridinsoft trust score of 0 / 100 and a single detection out of 93 security vendors on VirusTotal, confirming that at least one vendor has identified malicious behavior. The domain appears on one public blocklist and is already blocked by PhishDestroy, reflecting early takedown attempts by anti‑phishing services. No additional public blocklists or Safe Browsing entries are recorded, and the limited detection count suggests the site may be newly deployed or operating under a low‑profile configuration.

Defenders should immediately add drnsglobal.org to inbound and outbound filtering rules, enforce URL blocking at perimeter firewalls, and incorporate the IP address 206.168.149.10 into threat‑intelligence feeds. Given the WordPress‑based backend, compromised credentials or vulnerable plugins could be leveraged for credential‑harvesting campaigns, so monitoring for anomalous login attempts to any associated services is advisable. Continuous re‑scanning of the domain on multi‑engine platforms is recommended to capture any escalation in detection rates.