sabanciholding[.]app

Analysis of sabanciholding.app shows a short‑lived infrastructure that was registered on 21 February 2026 through Spaceship, Inc. The domain resolves to the IPv4 address 64.111.92.192, which is announced by AS399629 (BL Networks) and geolocated to the Netherlands. Nameserver records point to launch1.spaceship.net and launch2.spaceship.net, confirming the registrar’s DNS infrastructure. The web service operated without a TLS certificate, serving content over plain HTTP, and the page title returned by the server was "TraderBot". The limited metadata, combined with the classification "Banking Phishing" in the intelligence feed, indicates the site was intended to harvest credentials or financial information, likely by presenting a faux trading interface.

The domain appears on a single external security blocklist and is actively blocked by the PhishDestroy sinkhole. VirusTotal scans show that two of ninety‑five scanning engines flagged the domain, reinforcing the malicious assessment despite the low detection count. The site is currently offline, and no further HTTP response details are available.

Uncertainty remains around the exact payload, user‑experience, and whether additional supporting pages existed before takedown. Defenders should immediately add sabanciholding.app and its hosting IP 64.111.92.192 to network blocklists, monitor the associated nameservers for future registrations, and consider watching for new domains created by the same registrar within a similar time window. Continuous threat‑intel feeds should be queried for any resurgence of the "TraderBot" title or related banking‑phishing campaigns to ensure rapid detection of repeat infrastructure.