zomira[.]sbs

zomira.sbs was registered on 21 February 2026 and resolves to 46.151.182.165, an address located in Luxembourg and announced by AS205759 (Ghosty Networks LLC). The host presents a TLS certificate issued to "Plesk", and the HTTP response contains the title "Plesk Obsidian 18.0.74", which matches the branding of the Plesk control‑panel software. This combination of a recent domain, a legitimate‑looking SSL certificate, and a Plesk‑related page title is consistent with a generic phishing infrastructure that attempts to impersonate a legitimate administration interface to harvest credentials.

The domain has been added to one public security blocklist and was actively blocked by the PhishDestroy service. AlienVault OTX reports the domain in a single threat‑intel pulse, and VirusTotal records 16 of 93 scanning engines flagging the domain as malicious. As of the report date the site is taken offline, but the infrastructure remains reachable and could be reactivated.

Uncertainty remains regarding the exact phishing payload, targeted victim profile, and whether additional sub‑domains or infrastructure components exist. Defenders should add 46.151.182.165 to network‑level deny lists, monitor DNS queries for zomira.sbs and any future resolution to the same IP, and enforce TLS inspection to detect the Plesk certificate misuse. Threat‑intel feeds should be updated to include the domain and its associated indicators, and any internal logs showing connections to the IP or TLS handshake with the Plesk certificate should be investigated for possible credential‑theft attempts.