norqanto[.]sbs

The domain norqanto.sbs is currently classified as a high‑risk generic phishing site. It was registered on 10 March 2026 through Dynadot LLC and resolves to the IPv4 address 91.84.122.139, which belongs to ASN 216071 (SERVERS TECH FZCO) and is geolocated in the Netherlands. The authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net. The web service presents a TLS certificate issued by Let’s Encrypt (R13) and responds with an HTTP 302 redirection to a page whose title reads “RU • MaxUnique 10 • 2026”. Header analysis reveals the use of Nginx and the enforcement of HTTP Strict Transport Security (HSTS). Security‑engine assessments show a Gridinsoft trust score of 0 / 100 and a VirusTotal rating where 8 of 95 scanning engines flag the domain as malicious. The site is listed on two public blocklists and has been actively blocked by PhishDestroy and ScamSniffer. No additional infrastructure such as compromised hosts or secondary domains was observed in the available data. The observable evidence aligns with a typical generic phishing workflow: a short‑lived domain, a secure‑by‑default web server, and a redirection to a credential‑harvesting page. The page title suggests a possible affiliation with a Russian‑language campaign, but the content of the landing page has not been captured, leaving the exact phishing kit and the targeted brand ambiguous. The low trust score and multiple vendor detections confirm the malicious intent, while the active status indicates ongoing distribution. Defenders should immediately add norqanto.sbs and its resolving IP address 91.84.122.139 to deny‑list configurations at network perimeters and endpoint filters. Continuous monitoring of DNS queries for the domain and its name‑server pair is advised to detect any pivot to additional hosts. Given the high risk rating, security teams should also share the indicators of compromise with threat‑intelligence feeds to enhance community‑wide detection.