globiancev3[.]xyz

Analysis of globiancev3.xyz shows a short‑lived infrastructure typical of a generic phishing operation. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and has no SSL certificate, indicating that any data capture would occur over an unencrypted channel. DNS records point to four nameservers (ns27.asurahosting.com, ns27.my-control-panel.com, ns28.asurahosting.com, ns28.my-co) and resolve to the IPv4 address 198.251.89.220, which is announced by AS53667 (FranTech Solutions) and geolocated to the United States.

The site’s HTTP response returned the title “Problem loading page,” and the domain is currently taken offline, limiting immediate observation of its content. Threat intelligence sources list the domain on a single security blocklist and report that three of ninety‑five VirusTotal scanners flagged it, reflecting limited but notable detection. PhishDestroy has also blocked the domain.

The limited detection count and single blocklist entry suggest that the campaign may have been short‑lived or targeted a narrow audience before takedown. Defenders should ensure the domain and its resolving IP are added to network perimeter blocklists, monitor for any resurgence or re‑registration of similar suffixes, and consider extending detection rules to cover the associated name‑server patterns. Continuous review of threat‑intel feeds for new indicators related to AS53667 or the hosting provider is advised, as adversaries often reuse infrastructure across campaigns.