global1[.]b-krx[.]top

The domain global1.b-krx.top was registered on March 12, 2026 through NameSilo, LLC and is currently listed as offline. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served via Cloudflare infrastructure, as indicated by the presence of HSTS, Cloudflare Browser Insights, and HTTP/3 support, and the authoritative nameservers phil.ns.cloudflare.com and simone.ns.cloudflare.com. No SSL certificate was observed for the site, meaning HTTPS connections would rely on Cloudflare's default TLS handling rather than a domain‑specific certificate.

The page title returned from the site is "GlobalKRX," suggesting an attempt to impersonate a service or brand identified by that name, although no additional branding or content details are available. Security telemetry shows the domain has been flagged by three blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis reported a single detection out of ninety‑four scanning engines, indicating at least one vendor identified malicious behavior. The elevated risk rating reflects the combination of recent creation, use of reputable CDN services to obscure origin, and the presence of a detection.

Defenders should continue to block the domain at network perimeters, update URL filtering rules, and monitor for any resurgence of activity, especially given the low‑cost registration timeline that may be leveraged for future campaigns. Because the site is offline, no live payload or credential‑harvesting pages can be examined, leaving the exact phishing vector uncertain. Ongoing observation of the IP address and associated Cloudflare edge nodes is recommended to detect potential re‑use of the infrastructure for new malicious domains.