qmia[.]com[.]ng

PhishDestroy identifies the domain qmia.com.ng as an active generic phishing host under investigation. The site poses as an unconfirmed brand to harvest user credentials or deliver malicious payloads. No antivirus detections (2/95 on VirusTotal) and a Let's Encrypt SSL certificate suggest evasion tactics to bypass traditional defenses. The domain resolves to 163.61.188.9, a hosting range historically linked to low-trust activities. This site must be treated as hostile until further behavioral or IOC analysis proves otherwise.

This domain was flagged with zero VirusTotal detections out of 95 engines, utilizes Let's Encrypt for TLS, and points to IP 163.61.188.9 in OVH SAS hosting. The .ng ccTLD registry places registration oversight under Public Interest Registry–NIR, but registrant details remain obscured through privacy protection. Creation date is recent and blocklist coverage is presently nonexistent, indicating a newly deployed threat infrastructure. Trust scores from DomainTools and Cisco Talos rank the domain as low reputation, correlating with its lack of historical reputation and absence of benign categorization.

Mitigation requires immediate DNS blocking via firewall rules or hosts file redirection to 0.0.0.0. End users should avoid accessing the URL and report any accidental exposures through corporate SOC channels. Enterprises are advised to push IOCs to SIEM platforms and update proxy deny lists. For individuals, clear browser cache, disable auto-fill, and run a reputable antivirus scan after suspected interaction. Monitor network egress for outbound connections to 163.61.188.9 as a secondary detection measure.