temiz-corebit[.]com

This domain, temiz-corebit.com, is actively flagged as a high-risk phishing site targeting user credentials. Registered on February 21, 2026, through NETIM SAS, the domain resolves to 91.236.116.172, hosted by w1n ltd in Sweden. Analysis of its infrastructure reveals standard phishing indicators: a Let's Encrypt SSL certificate issued under the YR2 configuration, MX records pointing to mx1.netim.net and mx2.netim.net, and nameservers ns1.netim.net, ns2.netim.net, and ns3.netim.net. The HTTP status returns 200, confirming the site is operational and accessible as of July 12, 2026. Security vendors have detected malicious activity associated with this domain, with 13 out of 95 engines on VirusTotal flagging it as malicious. The domain also appears on at least one security blocklist, further supporting its classification as a phishing threat. The page title matches the domain name exactly, a common tactic in credential harvesting campaigns to mimic legitimate login portals. Gridinsoft's trust score of 0/100 reinforces the assessment of high risk, though the specific brand or service being impersonated remains unclear from available data. Defenders should prioritize blocking this domain at the DNS and network layers, particularly for organizations with users in regions or sectors commonly targeted by credential phishing. The use of Let's Encrypt certificates and NETIM-hosted infrastructure suggests a low-cost, disposable phishing operation, which may indicate broader campaign activity. Monitoring for related domains registered through the same registrar or resolving to the same IP range (91.236.116.0/24) could help identify additional threats. While the exact phishing kit or payload is not confirmed, the domain's active status and detection history warrant immediate mitigation to prevent potential credential theft or follow-on attacks.