globalwealthrise[.]com

Analysis conducted on 27 July 2026 identifies the domain globalwealthrise.com as an active generic phishing infrastructure. The domain was registered through Name.com, Inc. on 9 November 2024 and is currently delegated to the Cloudflare nameservers heather.ns.cloudflare.com and lamar.ns.cloudflare.com. DNS resolution points to the IPv4 address 104.21.81.214, a Cloudflare edge node that often serves as a front‑end for malicious payload delivery. The domain appears on a single security blocklist and has been flagged by the PhishDestroy service, indicating that at least one independent sinkhole has observed malicious activity associated with the host.

VirusTotal records show that the domain was examined by 91 scanning engines; none of the engines reported a detection at the time of analysis. The absence of detections does not constitute confirmation of benign behavior, and the result should be interpreted as a lack of current signatures rather than proof of safety. The limited visibility—only one blocklist entry and a single phishing‑specific feed—suggests that the campaign may be in an early deployment stage or operating with a narrow targeting scope.

Defenders are advised to enforce network‑level blocking of the domain and its resolved IP address, incorporate the nameserver information into threat‑intel feeds, and monitor for any future appearances on additional blocklists or detection services. Continuous re‑scanning of the host on platforms such as VirusTotal is recommended to capture emerging signatures. Given the recent registration date and the presence of Cloudflare‑based hosting, the infrastructure could be repurposed for further phishing campaigns, and any inbound traffic to the domain should be treated as suspicious until a definitive takedown is confirmed.