globalfirmcapital[.]com

globalfirmcapital.com was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on the IP address 107.172.61.186, which is part of AS36352 owned by HostPapa and geolocated to the United States. The domain uses the generic DNS servers ns1.renewyourname.net and ns2.renewyourname.net and presents an SSL certificate identified as R10. The only publicly visible page title is “Global Firm Capital | Home”, and the site is classified as a crypto‑scam that impersonates the Binance brand. VirusTotal scans show that two of ninety‑three security vendors flagged the domain, indicating partial detection of malicious indicators.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Current network probes report the site as taken offline, which aligns with the “offline” status in the intelligence feed. The evidence suggests a short‑lived infrastructure built specifically to lure victims interested in cryptocurrency services associated with Binance. The use of a reputable registrar and a common hosting provider does not mitigate the risk, as the attacker leveraged standard services to obtain a valid TLS certificate and resolve the domain.

At present, no additional artifacts such as malware hashes, phishing page screenshots, or credential‑harvesting URLs have been disclosed, leaving the exact attack vector and payload unknown. Defenders should add 107.172.61.186 and the domain name to network and endpoint blocklists, enforce DNS filtering for renewyourname.net name servers, and monitor for new registrations that share the same registrar, hosting ASN, or similar naming patterns. Continuous scouting of VirusTotal and other multi‑engine scanners for updated detection scores is advised, as further analysis may reveal additional malicious components.