cstakechome[.]com[.]theglobeswifts[.]com

The domain cstakechome.com.theglobeswifts.com is identified as an active crypto drainer phishing site, designed to fraudulently extract cryptocurrency assets from victims. Analysis of the page title, 'Home | Mobile , Credit Cards, Mortgages, Auto Loan,' suggests an attempt to impersonate a legitimate financial services provider, likely targeting users seeking banking or loan-related services. The domain remains operational as of the latest assessment, posing a high risk to unsuspecting visitors. Infrastructure analysis reveals that the domain was registered on January 20, 2026, through ENOM, INC., a registrar commonly associated with malicious activity. It resolves to the IP address 194.36.191.196, hosted under AS60117 (Host Sailor Ltd) in the Netherlands. Security vendor assessments on VirusTotal indicate that 12 of 95 engines flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and fraudulent sites due to its accessibility and cost-free nature. These technical indicators align with known patterns of crypto drainer infrastructure, where domains are rapidly deployed and discarded. Current status confirms the domain remains active, continuing to pose a significant threat to users. Organizations and individuals are advised to block access to the domain and its associated IP address at the network level. Users should exercise extreme caution when interacting with financial services online, particularly those advertised via unsolicited communications. Verification of domain legitimacy through official channels and multi-factor authentication (MFA) is strongly recommended to mitigate the risk of asset compromise. Security teams are encouraged to monitor for similar domains registered through ENOM, INC., and hosted on AS60117, as these may indicate related phishing campaigns.