globals-ray[.]ltd

This domain, globals-ray.ltd, is identified as a crypto drainer phishing site targeting users of the Globals Ray platform. Analysis indicates the site employs deceptive branding elements, including an identical page title, 'Globals Ray,' to mimic legitimate services and trick victims into connecting cryptocurrency wallets. The infrastructure is designed to execute unauthorized transactions, draining assets from compromised wallets upon interaction. No specific drainer kit has been conclusively attributed to this campaign, though similarities to known kits such as Angel Drainer and Inferno Drainer are under investigation. Infrastructure analysis reveals the domain was registered on April 10, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 163.61.188.5, which has been flagged in prior phishing campaigns. VirusTotal detection metrics show 13 out of 95 security vendors classify the domain as malicious, while it appears on one security blocklist. The domain is not currently listed on Google Safe Browsing (GSB), though this may reflect a lag in detection rather than a lack of malicious intent. The SSL certificate is issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to phishing sites. AlienVault OTX records the domain in one threat intelligence pulse, further corroborating its malicious classification. As of the latest assessment, globals-ray.ltd has been taken down, likely due to coordinated action by security researchers and hosting providers. However, residual risk persists due to the domain’s recent registration and the transient nature of phishing infrastructure. Users who interacted with the site prior to takedown may remain vulnerable to wallet compromise or follow-up attacks. Organizations and individuals are advised to monitor wallet activity for unauthorized transactions, revoke permissions for suspicious connected applications, and deploy endpoint protection capable of detecting crypto drainer scripts. Proactive measures, such as domain reputation checks and browser-based phishing filters, are recommended to mitigate exposure to similar threats.