globalarbitrageinvest[.]com

globalarbitrageinvest.com was registered on 21 February 2026 through OwnRegistrar, Inc. The domain points to the IP address 102.218.215.112, which is geolocated to South Africa and hosted by Hostafrica. It is served by the authoritative nameservers dan1.host-ww.net and dan2.host-ww.net, indicating that the attacker chose a generic hosting provider to obscure ownership.

The web service presents a TLS certificate issued by Let’s Encrypt (profile E6) and returns an HTTP 403 status code for default requests, a pattern commonly observed in phishing landing pages that block direct access while serving content only to specific user‑agents or after redirection. Gridinsoft assigns the domain a trust score of 0 out of 100, and VirusTotal records six detections out of ninety‑five scanned vendors, confirming that multiple security engines flag the site as malicious.

Analysis of the observed infrastructure links the domain to an investment‑type phishing campaign. The high‑risk classification aligns with the use of a financial‑themed domain name and the presence of the domain on a single security blocklist, where it is already listed by PhishDestroy. Although the content behind the 403 response has not been publicly harvested, the combination of a newly created domain, low trust score, and multiple vendor detections strongly suggests that the site is being used to lure victims into fraudulent investment schemes.

Defenders should immediately block 102.218.215.112 and the domain globalarbitrageinvest.com at perimeter firewalls and DNS resolvers. Continuous monitoring of the associated nameservers is advised to detect any future record changes. Organizations should also issue user awareness advisories warning that unsolicited communications referencing arbitrage investments may direct recipients to this domain, and should encourage reporting of any suspicious emails to incident response teams.