smtp[.]globaltelecommunications[.]co[.]in

Analysis of smtp.globaltelecommunications.co.in confirms its classification as an active phishing domain targeting webmail credentials. The domain, registered on February 21, 2026, through Infocom Network Private Limited, currently resolves to IP address 216.40.42.5, hosted on AS15348 (Tucows.com Co.) in Canada. The page title 'Webmail :: Welcome to Webmail' explicitly indicates an attempt to mimic legitimate email login portals, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the domain is served by nameservers server1.trade-india.com and server2.trade-india.com, which may warrant further scrutiny for associated malicious activity.

Detection data from July 23, 2026, shows the domain is flagged by 16 of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. The domain maintains an active HTTP 200 status, indicating the phishing page remains operational. A DigiCert-issued SSL certificate (GeoTrust TLS RSA CA G1) is present, which may lend a false sense of legitimacy to potential victims. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk assessment.

While the exact brand being impersonated is not specified in available data, the page title and domain structure strongly suggest a focus on corporate or service-provider webmail systems. Defenders should immediately block the domain and its resolving IP at network and endpoint levels. Security teams are advised to review logs for connections to 216.40.42.5 and monitor for credential submissions to this domain. Given the recent registration date and active status, this infrastructure may be part of a larger, evolving phishing campaign targeting enterprise communications.