sareeh-coinmark[.]com

Analysis indicates that the domain sareeh-coinmark.com is currently active and classified as a high‑risk generic phishing site. The site returned HTTP 200 and presents the page title “صريح كوينمارك | المنصة الرسمية Qatar 2026”, suggesting it may be targeting Arabic‑speaking users with a claim of official status for an event in Qatar 2026. No visual content has been examined, and the exact malicious payload is not yet disclosed, but the presence of a phishing classification is confirmed by multiple intelligence sources. Infrastructure analysis reveals that the domain resolves to the IPv4 address 94.26.38.51, which is hosted in Bulgaria and announced by AS202412 (Omegatech LTD). The web server stack consists of Nginx built on OpenResty, and the TLS certificate is issued by Let’s Encrypt (E8). Registration data shows the domain was created on 21 February 2026 through the registrar NETIM SAS, and it uses the default NETIM nameservers ns1.netim.net, ns2.netim.net, and ns3.netim.net. The Gridinsoft trust score is 0 out of 100, indicating a complete lack of trust. Threat indicators include a detection by PhishDestroy and a listing on at least one public blocklist. VirusTotal reports that 13 of 95 security vendors flagged the domain as malicious, reinforcing the high‑risk assessment. The combination of a low trust score, active blocklist entries, and multiple vendor detections provides concrete evidence that the domain is being used for phishing operations. Defenders should immediately block sareeh-coinmark.com at perimeter and DNS layers, and add its IP address 94.26.38.51 to network‑level deny lists. Continuous monitoring of the associated ASN and the NETIM nameserver range is advised to catch any potential repurposing. Incident response teams should treat any credential or payment information submitted to this domain as compromised, and users should be warned about the fraudulent nature of the site.