nectar-globe[.]com

Analysis of nectar-globe.com indicates a high-risk credential phishing domain active as of July 27, 2026. The domain was registered on March 16, 2026, through Dynadot Inc, with nameservers ns3.ddoscure.com and ns4.ddoscure.com, a configuration often associated with bulletproof or low-reputation hosting providers. It resolves to the IP address 5.196.175.67, which has been linked to previous malicious activity in threat intelligence feeds. The page title, as captured in telemetry, matches the domain name itself (nectar-globe.com), offering no immediate indication of a targeted brand but consistent with generic phishing infrastructure designed to harvest login credentials. VirusTotal telemetry shows that 6 of 91 security vendors flag this domain as malicious, a detection rate that exceeds typical thresholds for automated blocking.

The domain also appears on at least one security blocklist, specifically PhishDestroy, which specializes in phishing and fraud detection. No evidence from Google Safe Browsing, Open Threat Exchange, or SSL certificate anomalies is present in the current dataset, though the absence of these signals does not imply safety. The domain remains operational, serving content that has not yet been fully classified by all major scanning engines. Defenders should treat nectar-globe.com as an active threat.

Network-level blocking is recommended for the domain and its resolving IP. Organizations using Dynadot or the identified nameservers should review their domain registration and DNS management policies for potential abuse. Further investigation into the hosting provider (ASN and geolocation data for 5.196.175.67) may reveal additional linked infrastructure, though such details are not currently available in this assessment. Given the detection rate and blocklist presence, this domain is likely part of a broader phishing campaign targeting user credentials without a confirmed brand association.