globetechgroupco[.]com

Analysis on globetechgroupco.com, created on 2018-09-01, shows it is currently active and hosts a site that claims to target MetaMask users for a crypto‑gambling scam. The domain resolves to IP 193.243.147.110, which belongs to the OVH SAS network (AS16276) located in France. The hosting infrastructure runs Apache HTTP Server with a WordPress front‑end backed by MySQL and PHP, and the page incorporates Bootstrap and jQuery. The site presents a valid TLS certificate issued by Let’s Encrypt (R12) and returns HTTP 200 for the root URL, with the page title reported as “globetechgroupco.com”. Registration data indicates the domain was registered through ENOM, INC., and its authoritative nameservers are braelyn.ns.cloudflare.com and kolton.ns.cloudflare.com. Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on one security blocklist.

It is also listed in a single AlienVault OTX pulse. VirusTotal scans have flagged the domain by 13 of 95 security vendors, and PhishDestroy has actively blocked it. Further, the low Gridinsoft trust score of zero underscores the lack of benign reputation, while the presence on a security blocklist confirms that at least one protective service has identified the domain as malicious. The single OTX pulse indicates that the domain has been shared within the threat‑intel community, providing an additional source for correlation. The combination of a valid SSL certificate, a standard HTTP 200 response, and a generic page title does not mitigate the risk, as these attributes are commonly used to increase credibility.

The use of Cloudflare nameservers may be intended to obscure the true origin of the domain, although the underlying IP remains traceable to OVH in France. Because the site is built on widely available open‑source components, the infrastructure can be rapidly re‑hosted if takedown attempts succeed, suggesting a resilient threat actor. Defenders should block network connections to 193.243.147.