darb[.]qmobilitysig[.]com

The domain darb.qmobilitysig.com was registered on February 21, 2026 through Alibaba Cloud Computing Ltd. d/b/a HiChina and is delegated to the dns11.hichina.com and dns12.hichina.com name servers. DNS resolution points to the IPv4 address 43.160.248.36, which is located in Singapore and belongs to AS132203 (Tencent Building, Kejizhongyi Avenue). The site does not present a TLS certificate, meaning it is served over plain HTTP only. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy currently lists it as a malicious entry. VirusTotal analysis shows that 20 of 93 security vendors have raised detections against the host, reinforcing the malicious assessment.

The Gridinsoft trust score is 0 out of 100, and the domain appears on one additional public blocklist. The page title retrieved from the live host was "Security Verification - Please Wait", which aligns with the known Verification Scam kit used in credential‑harvesting campaigns. This kit typically displays a waiting screen that coerces users into providing login credentials or personal data to "verify" their account, and its presence combined with multiple vendor detections classifies the domain as a high‑risk phishing resource. No further page content has been captured, so the exact data‑collection mechanisms remain unconfirmed.

Defenders should add darb.qmobilitysig.com to URL filtering and endpoint deny lists, block the associated IP address 43.160.248.36 at network perimeters, and ensure DNS queries for the domain are denied. Although the site is currently offline, continuous monitoring of the registrar's WHOIS records and the hosting ASN is recommended to detect any re‑registration or migration to new infrastructure. Security teams should also watch for additional subdomains under qmobilitysig.com, as attackers often reuse the same hosting environment.