fidomira[.]sbs

This domain, fidomira.sbs, is identified as a credential theft operation specifically targeting users of the Binance cryptocurrency exchange. The site presents a fraudulent login interface titled 'Giriş Yap,' designed to deceive visitors into submitting their account credentials. Analysis indicates the domain is engineered to capture sensitive information, including usernames, passwords, and potentially two-factor authentication codes, which could lead to unauthorized account access and financial theft. The impersonation extends to visual and structural elements of the legitimate Binance platform, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of fidomira.sbs. The domain was registered on February 21, 2024, through Dynadot LLC, a registrar frequently utilized in phishing campaigns. It resolves to the IP address 46.151.182.165, hosted under AS205759 (Ghosty Networks LLC) in Luxembourg. Detection metrics further substantiate the threat: 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while one security blocklist, PhishDestroy, has already classified it as a phishing resource. The SSL certificate, issued by R12, does not mitigate the risk, as fraudulent domains commonly employ valid certificates to appear legitimate. Users who visited fidomira.sbs or entered credentials on the site should take immediate corrective action. First, cease all interaction with the domain and avoid clicking any links received via email, SMS, or social media directing to it. Affected individuals must change their Binance account passwords without delay, using a strong, unique passphrase. If two-factor authentication (2FA) was enabled, reset the 2FA settings and revoke any backup codes previously generated. Monitor the account for unauthorized transactions or configuration changes, and report suspicious activity to the platform’s official support channels. Additionally, scan local devices for malware, as credential theft sites may deploy additional payloads to compromise user systems.