qomira[.]sbs

This domain, qomira.sbs, is flagged as a brand impersonation threat targeting Binance, a major cryptocurrency exchange platform. Analysis of the page title, Giriş Yap | Binance TR, confirms the domain mimics Binance’s Turkish login portal, a common tactic in credential harvesting campaigns. No explicit drainer kit signatures were detected, but the infrastructure aligns with phishing operations designed to capture user credentials and two-factor authentication codes. The domain’s targeting of a specific regional portal (Binance TR) suggests a localized attack vector, likely aimed at Turkish-speaking users. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on February 21, 2026, an unusually future-dated creation that may indicate domain generation algorithm (DGA) abuse or pre-registered malicious assets. VirusTotal reports 18 out of 95 security vendors flagging qomira.sbs as malicious, with detections categorized under brand impersonation and phishing. The domain resolves to IP address 46.151.182.165, hosted under AS205759 (Ghosty Networks LLC) in Luxembourg, a provider frequently associated with bulletproof hosting. The SSL certificate is classified as R12, a low-assurance certificate type often exploited in phishing campaigns. The domain appears on one security blocklist and is blocked by at least one anti-phishing engine, further corroborating its malicious classification. As of the latest assessment, qomira.sbs has been taken offline, likely in response to detection and reporting. However, the domain’s infrastructure remains a residual risk, particularly if the hosting provider or registrar fails to implement permanent remediation. The future-dated registration suggests potential for reactivation or reuse in subsequent campaigns. Users who accessed the domain prior to takedown should assume credential exposure and initiate password resets, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations are advised to update blocklists with the domain and IP address, and to conduct retrospective analysis of logs for connections to 46.151.182.165 or qomira.sbs to identify potential compromise.