cpcontacts[.]applyglobaldynamic[.]com

On July 25, 2026 the domain cpcontacts.applyglobaldynamic.com was catalogued as a high‑risk generic phishing infrastructure with the unique seed 19d739. The domain is currently active and returns an HTTP 403 status code, indicating that direct content retrieval is blocked, yet its presence on malicious infrastructure lists confirms hostile intent. The domain is registered through Ultahost, Inc. and is served by four authoritative name servers (ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, ns4.ultahost.com), which is consistent with the registrar’s default hosting configuration.

Threat intel platforms have flagged the domain: it is listed on one security blocklist and is blocked by the PhishDestroy sinkhole, demonstrating that at least one dedicated anti‑phishing service has intercepted traffic destined for this host. VirusTotal analysis shows that 4 of 91 security vendors flagged the domain as malicious, providing independent corroboration of its phishing nature. No additional public evidence such as page titles, SSL certificate details, or brand targeting is presently available, so the exact phishing lures employed remain unknown.

Defenders should prioritize immediate DNS‑level blocking of cpcontacts.applyglobaldynamic.com, incorporate the domain into web‑filter rule sets, and monitor outbound connections to the associated name servers for any anomalous activity. Continuous re‑scanning of the domain on multi‑engine platforms is advised to capture any evolution of the payload or additional vendor detections. Given the high risk rating and active status, organizations are encouraged to treat any traffic to this domain as hostile and to employ endpoint detection capabilities that can flag attempted credential submissions associated with the domain.