darb[.]itc[.]gov[.]ae-qovt[.]com

This domain, darb.itc.gov.ae-qovt.com, operates as a fraudulent government portal designed to harvest login credentials through brand impersonation. The infrastructure mimics legitimate United Arab Emirates government services, specifically the Darb platform, to deceive users into entering sensitive authentication details. Analysis of the domain's behavior indicates it presents a fabricated login interface under the guise of an official portal, likely targeting government employees, contractors, or citizens accessing digital services. The threat type aligns with credential phishing, where stolen credentials can lead to unauthorized access, data breaches, or further exploitation in targeted campaigns.

Evidence confirms the domain's malicious nature through multiple technical indicators. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, with detection labels including phishing and fraudulent content. The domain was registered on February 21, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 43.160.249.131, hosted in Singapore under AS132203, and currently appears on one security blocklist. Notably, the domain lacks an SSL certificate, which is atypical for legitimate government services and further undermines its credibility. The page title 'Access Denied' suggests the phishing kit may have been taken down or is configured to evade automated scanners.

Users who visited darb.itc.gov.ae-qovt.com should assume their credentials or sensitive information may have been compromised. Immediate steps include changing passwords for any accounts accessed through the site, enabling multi-factor authentication where available, and monitoring accounts for unauthorized activity. System scans using updated security tools are recommended to detect potential malware or follow-up threats. Organizations should block the domain and its associated IP address (43.160.249.131) at the network level to prevent further exposure. Reporting the domain to relevant cybersecurity authorities or incident response teams can aid in broader mitigation efforts.