Global Rift: Scam or Legit? CNMV Warning, Shared Backend, No Named Owner

Global Rift sells online trading accounts from $200 on two near-identical websites, and on October 19, 2026 Spain’s securities regulator, the CNMV, warned the public about both of them.

We read that warning and checked both sites: no company, no license, no address, no terms, and a form that sends your details to a third domain.

Overview

What the Site Offers

We found a one-page site that promises smart trading based on data and automatic signals, and then pushes you to open a trading account.

Three account tiers are priced from $200, $1,500 and $5,000, and every button leads to a sign-in page on a separate subdomain.

The home page also shows a live price table for six cryptocurrencies, and a contact form that asks for a name, email, country and phone number.

What the Checks Found

The CNMV lists Global Rift on its register of unauthorized entities and names both globalrift-ltd.co and globalrift-limited.com in its warning.

The footer calls the business Global Rift, Inc., while the domains read Limited and Ltd, and neither the page nor the code names a registered company.

The contact form posts your details to pr-spacesocks.com, a domain registered on September 19, 2025, and the same server serves the trading platform behind the login.

Two other brands run the same platform stylesheet and the same server, and a third domain with the Global Rift name, from May 2026, now answers with an error.

What We Could and Could Not Verify

Here is where the evidence stands after our checks:

• Verified by us: the CNMV entry, both warning documents, the page text and code, the domain and certificate dates, and the shared server address.
• Not found: a company name, a registration number, a license, a postal address, terms of service, a privacy policy or a risk warning.
• Not verified: where deposits go, whether withdrawals work and who runs the business. We did not register, log in, pay or submit the form.

Our advice is not to deposit anything, and the sections on what to do below also cover anyone who already did.

The CNMV Warning We Read

We started with the regulator, because its warning is the one document about Global Rift that someone with legal authority wrote.

On the CNMV warnings page we searched the register of unauthorized entities for Global Rift and got a single row, dated October 19, 2026, naming GLOBAL RIFT.

The row links to two PDF notices, one in Spanish and one in English, and we opened and read both.

The English notice is headed as a warning to the public on an unregistered firm, and it names Global Rift with the two web addresses globalrift-ltd.co and globalrift-limited.com.

It lists the entity as not authorized to provide investment services reserved under Article 129 of Spain’s Securities Markets and Investment Services Act, including foreign currency transactions.

It adds that the entity is not authorized for the crypto-asset services listed in Regulation (EU) 2023/1114, which require prior authorisation under Article 59.

The notice gives no company form, address, phone number or person, only the brand and two domains, so it shows what Global Rift lacks, not who stands behind it.

The notice also points investors to the CNMV enquiry line on 900 535 015 and to the regulator’s website.

The regulator’s own guidance limits its powers to the administrative sphere, so a warning is not a court finding and we do not treat it as one.

It is still the strongest fact in this case, because it tells a Spanish resident that no register entry exists for the firm.

The time line matters too. The warning appeared 62 days after globalrift-limited.com was registered and 111 days after the first certificate was issued for globalrift-ltd.co.

We also searched the same register for Secondwise and for Data Capital, two names we meet later, and the register returned no data for either.

What the Front Door Offers

We loaded the home page in a browser and read its code as plain text, because the server sends only 884 bytes of HTML and a script builds the rest.

The page opens with the line digital savvy in trading, followed by a promise of smart trading based on data, automatic signals and adaptive strategies.

Three boxes follow, headed data not guesswork, adaptation to markets and 360 degree diversification, and the text under them speaks of stable income and verified signals.

None of those sentences contains a number, a track record, a fee, a leverage limit or a name, so a reader has nothing to test.

The instruments section lists cryptocurrencies, stocks, ETFs and bonds, yet the only market data on the page covers six crypto assets.

The pricing section lists three accounts. Silver starts at $200 and offers to start with minimal risk, Gold starts at $1,500 and Platinum starts at $5,000.

Gold and Platinum carry exactly the same three bullet points: advanced tools, low spreads and high-volume trading. The page gives no spread, no commission and no leverage for any tier.

Every open trading account button, four in all, links to the same sign-in address, so the tiers are labels and not separate offers.

The menu has five entries, and we checked in the live page where each link lands.

Four of them jump to sections of the page. The fifth, contact us, points to a section named contact, and no element with that name exists in the page.

That is a small flaw, but it shows a page that was never tested end to end by someone who answers to customers.

The footer reads Global Rift, Inc., all rights reserved. We found no terms, privacy policy, risk warning or address anywhere in the page or its code.

A Market Table That Mislabels Its Numbers

The trade view section looks like the most serious part of the page, so we checked where its numbers come from.

The code requests the public 24-hour ticker for each coin from Binance’s open API and refreshes it every 60 seconds.

That is real market data, and it proves nothing about Global Rift, because anyone can embed the same feed without owning a trading venue.

Then we compared the column labels with the fields the code reads. Market cap is filled from the exchange’s trade count, and volume from the traded amount.

The code then adds the letter T to the first figure and the letter B to the second, which turns raw counts into what read like trillions and billions.

When we loaded the page on November 12, 2026 it showed Bitcoin at 73,669.08 USD, a market cap of 3518077.000T and a 24-hour volume of 14652.857B.

At that price, and with roughly 20 million bitcoin in circulation, which is our estimate and not a figure on the page, the real market value is around $1.5 trillion.

The USDC row shows a volume of 1228285226.000B, which with the added letter would read as more than a quintillion, and no market trades that much.

A site that cares about traders would have caught this on the first test, so the table reads as decoration copied from a template.

One more detail sits in the same code: the message logged when the price request fails is written in Russian.

We mention that as a fact about the file, not as a clue to its author.

Where the Contact Form Sends Your Details

The form was the next thing we read, and we never typed into it or submitted it.

It asks for a name, surname, email, country and phone number, and the country list is loaded from a public countries service.

On submit the code builds a record and sends it to https://pr-spacesocks.com/lead/register-lead-from-brand, a server that is not either of the two Global Rift domains.

Besides your four details, the record carries three values that the visitor never sees and cannot change.

The amount field is fixed to the text more 5000, the category field is fixed to socarinvest, and the message field is fixed to 0.0.0.0scscscs.

So every visitor, whether they wanted to try $200 or only to ask a question, reaches the receiving system labeled as a lead for more than 5000.

The same fixed values appear in the code of both domains, which tells us the form was never adapted to either brand.

The page also tells you that it received your request without checking whether the server did.

In the code, the thank-you message appears as soon as the request finishes, and the reply status is never read.

A visitor sees we will contact you soon even if the server rejected the lead, which is a design that prefers a calm screen to a true one.

We looked up pr-spacesocks.com in RDAP. It was registered on September 19, 2025 at Tucows and sits behind Cloudflare, and its home address answers 401 unauthorized.

The name suggests an unrelated business, and nothing on the domain explains why a trading site would send leads there.

What this proves is limited, and we want to be exact: a data-collection server sits outside the brand, and we cannot tell who runs it.

Domains That Arrived in Waves

We used RDAP, certificate logs and the web servers’ own headers to date each Global Rift domain, and the dates fall in three steps.

The first is globalrift-ltd.com, registered on May 27, 2026 at Tucows. Cloudflare answered with a 525 error, so we cannot show it belonged to the same business.

The second is globalrift-ltd.co. The .co registry offers no public RDAP service, so we cannot read its registration date, but its first certificate was issued on June 30, 2026.

The third is globalrift-limited.com, registered on August 18, 2026 at 11:38 UTC. Its first certificates followed the same day.

The trading platform page on its subdomain carries a file date of August 18, the same day, while the older ltd.co copy dates from June 30.

The two home pages are the same page. After swapping the sign-in address and logo link, the two scripts match byte for byte.

Both logos load from a free image-hosting service, not from the sites themselves.

The main script file on globalrift-limited.com carries a modification date of October 26, 2026, one week after the CNMV warning, and we cannot see what changed.

The Internet Archive’s availability check returns no snapshot for either live domain, so we have no earlier version of the pages to compare.

A business that has been trading for years rarely moves between three domains in five months, and the sequence fits a brand that is rebuilt on a new address.

We stop short of saying the three belong to one operator, because a similar name on a similar setup is not proof of common ownership.

The Same Template on Other Domains

The code of the sign-in app told us the most about the setup, so we downloaded it as text and never ran it.

It is the same file on the Global Rift subdomains pro.globalrift-limited.com and web.globalrift-ltd.co, with the same size and the same checksum.

Its server address, pr-spacesocks.com, is built into the code, and every request goes there, with a bearer token added after you log in.

The app ships its text in 22 languages, including Spanish, German, Italian, Dutch and Japanese, while the Global Rift home page itself exists only in English.

Its endpoint names mention accounts transferred to CFD accounts, a list of leverages and CFD brand settings, which suggests that what is traded are contracts for difference.

That matters, because the home page talks about stocks and bonds, and a contract for difference gives you a bet on a price, not ownership of the asset.

We then looked for other sites that call the same server and found two: direct.secondwise-limitedcapital.com and direct.data-capital.ltd, both titled Trading Platform.

Both load a stylesheet that is identical to Global Rift’s, byte for byte, and both carry the same address for their server inside the app.

Their main scripts are different builds, about 2.53 million bytes each against about 2.57 million for Global Rift, so this is a shared product and not a copy.

The parent domain secondwise-limitedcapital.com was registered on October 19, 2026, the same day as the CNMV warning. When we opened it, Cloudflare showed an interstitial titled Suspected Phishing.

We did not go past that page. The other parent, data-capital.ltd, serves a short page titled Data Capital LTD.

A shared server and a shared stylesheet show a common setup, which could be a vendor supplying the same platform to many brands. They do not prove common ownership.

How the Global Rift Pitch Works

Step 1: A clean page and a promise

A visitor meets a dark page with a bull in bitcoin glasses, a pitch built on data and signals, and no statement of risk anywhere on the screen.

The prices and the live table give the page the look of a working market.

Step 2: A button, or a form, that captures you

Every button goes to the sign-in page, and the contact form sends your name, email, country and phone number to the outside server.

That is enough for someone to call you, and the fixed amount field means each lead arrives labeled as a large prospect.

Step 3: An account on a shared platform

The sign-in page asks for an email or mobile number and offers a sign-up link, and it tells you to make sure you are on the correct address.

We did not create an account. The code behind it handles deposits by bank transfer, crypto transfer and card, and it holds withdrawal and transfer forms.

Step 4: A deposit to details you cannot see

The code has fields for a beneficiary, IBAN, SWIFT and routing number, and for crypto deposit addresses, and the actual details sit behind the login.

We never saw the names or numbers a depositor would pay, so we cannot tell which company, bank or wallet receives the money.

Step 5: A withdrawal that depends on someone you cannot find

The app has withdrawal forms and messages for transaction updates, but nothing on any page we read names a company that would owe you the money.

If a payout stalls, you would have no named business to write to, no license to cite and no address for a court.

Who Is Behind Global Rift?

The company named in the documents

The CNMV notice names a brand, Global Rift, and two domains. It does not name a company, and neither does anything we read on the sites.

The footer reads Global Rift, Inc., which would normally point to an American corporation, but the domains read Limited and Ltd, and the page gives no state, number or address.

We searched the UK Companies House public search for global rift limited and global rift ltd. Neither query returned a company with that name.

Where the address and registration lead

No postal address, phone number or registration number appears in the pages or the code, so there is nothing to look up in a business or financial register.

The domains sit behind Cloudflare, which hides the real server address, and Cloudflare is used by honest sites and dishonest ones alike.

The only external address in the code is the lead server, and its registration data in RDAP shows a registrar but no readable owner.

Domain, platform and reviews

Three domains with the Global Rift name were registered or first certified between May and August 2026, and the oldest one now fails to load.

The platform is a shared product used by at least two other brands, and one of their parent domains was registered on the day of the CNMV warning.

We did not rely on review sites. We found no independent record of a company, a license or a client who withdrew money.

What we could not confirm

We could not confirm who runs Global Rift, who owns the lead server, whether the three domains share an owner, or where a deposit would go.

We also did not test the platform with an account, so we cannot tell whether trades execute, whether prices are real or whether withdrawals work.

We did not query the UK, Italian or other European warning lists for these domains, and we did not try to bypass the Cloudflare page on the sister site.

What to Do If You Signed Up or Deposited

1. Do not deposit. A firm that the CNMV lists as unregistered and that names no company gives you nobody to hold responsible, so keep your money in a regulated account.

2. Check the register yourself. Search the regulator in your country for the firm, and treat a missing entry as a no, whatever the website promises.

3. Do not give your phone number. If you filled in the contact form, expect calls and messages, and do not move to a call, a chat app or screen sharing.

4. Stop paying. Do not send a top-up, fee or tax payment to unlock a withdrawal, because that is the usual next step in a trading fraud.

5. Save the evidence. Keep screenshots of the account, your user ID, every receipt, the wallet addresses or bank details you paid and every message from people who contacted you.

6. Ask your bank about a wire. Contact the bank that sent a wire at once, give the transfer details and ask whether a recall is possible, since speed matters.

7. Dispute card payments. If a card was involved, send your issuer a dispute letter as soon as you can and keep a copy.

8. Report it. File a report with your national regulator and at ReportFraud.ftc.gov, with the domains and amounts, and treat any offer to recover money for a fee as another fraud.

Frequently Asked Questions

Is Global Rift a scam?

We cannot prove what its operators intend, but it has a regulator’s warning, no named company and a lead form sending data to an outside server.

We would not trust it with money.

Is Global Rift licensed?

We found no license claim on either site, and the CNMV lists the entity as not authorized to provide investment services in Spain.

Are globalrift-ltd.co and globalrift-limited.com the same company?

Their home pages are the same page with two small differences, and the CNMV warns about both together, but no document we read proves one owner.

Is the Binance price table proof that it trades real markets?

No. The table copies a free public feed that any site can show, and two of its three columns are labeled wrongly.

What does the fixed 5000 amount in the contact form mean?

Every lead is sent with the text more 5000 whatever the visitor typed, so the receiving system sees each contact as a large prospect.

What if I already sent money?

Tell your bank or card issuer at once, save every receipt, tell your regulator about the domains, and ignore anyone who promises to recover the money for a fee.

The Bottom Line

Do not deposit at Global Rift or give it your phone number. A regulator warns about both domains, the business names no company, and its form sends your details elsewhere.

If you want to trade, pick a broker listed on your own regulator’s register and type the address yourself, not from an ad or a call.

If you already paid, stop sending money, save every receipt, call your bank or card issuer today, and send the domains and payment details to your national authority.