global-tru[.]biz

On 2026-08-04 the domain global-tru.biz was observed actively serving a generic phishing campaign. VirusTotal records indicate that 14 of 91 scanning engines have flagged the domain as malicious, providing a modest but notable consensus among security products. The domain resolves to the IPv4 address 65.98.127.26; no additional hosting infrastructure has been disclosed, and the IP is not currently associated with known safe-hosting services. The site is listed on a single public security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, confirming that at least one anti‑phishing network has taken mitigation action.

The threat is classified with an elevated risk level, reflecting the potential for credential harvesting or other fraudulent activity. Open-source intelligence does not yet contain a page title, SSL certificate details, HTTP response codes, or evidence of a targeted brand, so the exact lure used by the malicious page cannot be described. Consequently, defenders cannot rely on content-based signatures and must focus on network-level indicators.

Recommended defensive steps include adding the domain and its resolving IP address to outbound filtering rules, ensuring that DNS resolvers block queries for global-tru.biz, and updating intrusion-prevention signatures that reference the 14 VirusTotal detections. Continuous monitoring of the IP 65.98.127.26 for new activity and periodic re-scanning of the domain with sandbox services are advisable to detect any evolution of the campaign. Organizations should also inform users about the presence of this domain to reduce the likelihood of successful credential submission.