takmania[.]com

Analysis of takmania.com indicates a confirmed phishing domain operating under the guise of a Polish-language site, as evidenced by its page title 'TAKmania - Powiedz życiu TAK.' The domain was registered on March 23, 2026, through Namewinner LLC and currently resolves to IP 172.67.168.61, hosted behind Cloudflare infrastructure in Canada. Infrastructure analysis reveals the use of WordPress, PHP, MySQL, Yoast SEO, reCAPTCHA, and jQuery libraries, suggesting a standard CMS-based phishing kit rather than a custom-built malicious site. The domain appears in 9 threat intelligence pulses on AlienVault OTX and is listed on at least one security blocklist. Gridinsoft assigns a trust score of 0/100, and 3 of 94 security vendors on VirusTotal flag the domain as malicious. The site returns an HTTP 301 redirect, which may indicate an attempt to evade detection or redirect victims to a secondary malicious endpoint. The SSL certificate is issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious sites due to its free availability. While the exact phishing lure remains unconfirmed, the Polish-language page title suggests targeting of Polish-speaking users. Defenders should block the domain and its resolving IP at the perimeter, monitor for connections to 172.67.168.61, and investigate any internal systems that have accessed takmania.com since its registration in March 2026. The domain remains active as of July 12, 2026, and has not been taken down by its registrar or hosting provider.