inverdig[.]sbs

This domain is flagged for elevated-risk brand impersonation targeting Binance, a major cryptocurrency exchange. The specific threat involves a fraudulent login portal titled 'Giriş Yap,' designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the domain was actively used to mimic Binance’s official login page, increasing the likelihood of successful phishing attacks against unsuspecting users. Infrastructure analysis reveals multiple high-risk indicators. The domain inverdig.sbs was registered on December 17, 2025, through Dynadot LLC, a registrar frequently associated with abusive registrations. It resolves to the IP address 46.151.182.165, hosted under AS205759 (Ghosty Networks LLC) in Luxembourg, a network with a history of facilitating malicious activity. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while PhishDestroy has explicitly blocked it. The SSL certificate (R12) further suggests automated or low-trust issuance, a common trait in phishing infrastructure. Additionally, the domain appears on at least one security blocklist, reinforcing its classification as a confirmed threat. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (46.151.182.165) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into security monitoring systems to detect potential lateral movement or credential reuse attempts. End-users should be educated on verifying domain authenticity before entering credentials, particularly for financial or cryptocurrency platforms. Given the domain’s current offline status, continuous monitoring for reactivation or related infrastructure (e.g., newly registered lookalike domains) is recommended. Security teams should also review logs for prior interactions with this domain to assess potential exposure.