darb[.]qmobilitthyd[.]com

This domain, darb.qmobilitthyd.com, is identified as a credential theft operation designed to harvest user login credentials through deceptive web forms. Analysis indicates no association with legitimate brands or cryptocurrency platforms, though the page structure mimics common login portals to induce user submissions. The absence of SSL encryption further suggests an intent to intercept unsecured data transmissions, a hallmark of low-effort phishing infrastructure. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited on February 21, 2026, and resolves to the IP address 43.160.206.90, hosted within AS132203 in Singapore. Detection metrics show 21 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on a single blocklist and is actively blocked by one security engine. The domain lacks Google Safe Browsing (GSB) coverage, leaving gaps in browser-based protections for end users. As of the latest assessment, darb.qmobilitthyd.com has been taken offline, likely in response to detection and reporting. However, the registrar and hosting infrastructure remain active, posing a residual risk for potential re-deployment under a new domain. Users who may have interacted with this site are advised to reset credentials on any accounts accessed during the exposure window and monitor for unauthorized activity. Organizations should update blocklists to include the IP and registrar details to mitigate future threats from this actor.