gotxglobe[.]com

This domain, gotxglobe.com, operates as a fraudulent payment portal designed to harvest user credentials and financial information. Analysis of its infrastructure reveals it mimics legitimate payment processing services, as indicated by its page title 'txglobe | Seamless Payments.' The site employs deceptive design elements to trick users into entering sensitive data, such as login credentials or payment details, under the guise of a trusted transaction platform. Evidence supporting its malicious nature includes detection by 3 independent security blocklists, with MetaMask, SEAL, and PhishDestroy explicitly blocking access. VirusTotal analysis shows 3 out of 95 security vendors flagging the domain as malicious. The domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 49.13.41.188. Additional technical indicators include the use of Node.js, React, Next.js, and Webpack, alongside HSTS implementation, which may be leveraged to appear more legitimate. The SSL certificate is issued by Let's Encrypt, a common tactic to evade browser security warnings. Users who visited this domain should immediately revoke any entered credentials, particularly those associated with financial accounts or cryptocurrency wallets. Monitor linked accounts for unauthorized transactions and enable multi-factor authentication where available. If payment details were submitted, contact the relevant financial institution to report potential fraud. Security teams should update blocklists to include this domain and its associated IP address, while also analyzing network logs for connections to 49.13.41.188 or related infrastructure.