globitexx[.]com

This domain, globitexx.com, is identified as a high-risk phishing site targeting users of the Globitex cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the legitimate Globitex brand, likely to harvest login credentials, private keys, or facilitate unauthorized fund transfers. No specific drainer kit signatures were detected in initial scans, though the infrastructure aligns with common crypto-phishing tactics observed in similar campaigns. The page title 'Globitex' further confirms the impersonation intent, with no additional branding elements or legitimate content found during active periods. Infrastructure analysis reveals the domain was registered on April 06, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolved to the IP address 188.114.97.3, which has been linked to other phishing operations in recent months. VirusTotal detection metrics show 14 out of 95 security vendors flagged the domain as malicious, while it appeared on three independent security blocklists. The domain was also blocked by MetaMask, PhishDestroy, and SEAL, indicating active countermeasures by browser extensions and security tools. Google Safe Browsing (GSB) did not list the domain at the time of analysis, though this may reflect a lag in detection rather than legitimacy. As of the latest verification, globitexx.com has been taken offline, likely due to registrar enforcement or hosting provider intervention. While the domain no longer resolves, the risk of re-emergence remains high, as threat actors often redeploy phishing infrastructure under new domains or IPs. Users who interacted with the site should assume credential compromise and take immediate action: revoke active sessions, rotate passwords, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and IP, while security teams should investigate potential lateral movement if the domain was accessed within corporate networks. Continuous monitoring of related infrastructure (e.g., registrant email, nameservers) is recommended to preempt future threats.