goformation[.]sbs

PhishDestroy identifies goformation.sbs as an active crypto-draining phishing domain leveraging the Forma Finance brand to siphon user funds via a drainer kit embedded on the landing page. The infrastructure is tuned to harvest wallet credentials or directly approve malicious token transfers, exposing visitors to immediate financial loss. The domain was registered on March 20, 2026 and first observed hosting a copycat Forma Finance login page that silently requests wallet connections and signature approvals, typical of modern address-drainer campaigns.

Technical indicators are consistent with an emerging threat cluster: the domain resolves to 161.97.122.255 and is served over an SSL certificate issued by Let’s Encrypt. VirusTotal analysis shows only 2 out of 95 participating engines currently flag the domain, while the Google Safe Browsing database already marks it as malicious. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, and PhishDestroy’s telemetry places goformation.sbs on a single third-party blocklist. Creation date and resolution endpoint correlate with other known drainer infra active during Q1 2026.

The threat is presently active and propagating via social-engineering vectors targeting DeFi users. MetaMask has already added goformation.sbs to its phishing blocklist, reducing exposure for MetaMask users. PhishDestroy continues to monitor the campaign via seed 730166 and updates enterprise blocklists automatically. Despite this defensive layer, the domain remains accessible to unsuspecting visitors arriving through alternative channels such as phishing emails or imposter advertisements. Users are urged to verify any link ending in .sbs against PhishDestroy’s real-time scanner before entering credentials or signing transactions.