globalprimefinance[.]org

globalprimefinance.org was registered on March 18 2026 through the Hostinger Operations, UAB registrar and is hosted on name servers ns1.dns-parking.com and ns2.dns-parking.com. DNS resolution points to the IPv4 address 147.93.88.9, an address that currently appears on a single security blocklist and is listed as blocked by the PhishDestroy feed. The domain has been identified by VirusTotal, where one of ninety‑one scanned security vendors flagged it as malicious, indicating at least one detection of phishing‑related activity. The same detection sources place the domain in an active state, confirming that the infrastructure remains reachable.

The limited set of observables suggests a typical phishing deployment that leverages a recently created domain with inexpensive hosting and generic parking name servers. No additional metadata such as SSL certificate details, HTTP response codes, page titles, or content analysis has been published, leaving the exact payload and targeted brand unconfirmed. Likewise, the absence of multiple blocklist entries or broader vendor consensus means the detection surface is currently narrow, and the threat may evade some defensive layers that rely on reputation. Defenders should prioritize adding 147.93.88.9 and the FQDN globalprimefinance.org to deny‑list or URL filtering policies, especially in environments that process financial communications.

Monitoring of DNS queries for the domain and its name‑server patterns can provide early warning of related campaigns. Because the registrar and name‑servers are commonly used for disposable or fast‑flux domains, further investigation of other domains that resolve to the same IP or share the same name‑servers is advised. Continuous re‑scanning on multi‑vendor platforms such as VirusTotal is recommended to capture any escalation in detection counts.