qadiriyyahtvr[.]com[.]ng

The domain qadiriyyahtvr.com.ng is a confirmed phishing site engaged in brand impersonation targeting users of the platform manta. It was designed to deceive visitors into believing they were interacting with the legitimate manta service, potentially leading to credential theft or financial fraud. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk to users.

Technical analysis shows qadiriyyahtvr.com.ng was flagged by 1 of 95 security vendors on VirusTotal, including Gridinsoft, which assigned a trust score of 0 out of 100. Google Safe Browsing did not flag the domain, but it appeared on one security blocklist, PhishDestroy. The domain was registered through HostAfrica on April 24, 2025, and resolved to the IP address 192.3.190.186, hosted by AS36352 (HostPapa) in the US. The SSL certificate was issued by Let's Encrypt (R13), and the observed page title was 'Qadiriyya TVR – Ilimantarwa wayar da kan jamaa'. Nameservers for the domain were dns1.webproserver.com and dns2.webproserver.com.

Users who visited qadiriyyahtvr.com.ng should immediately change any passwords entered on the site, especially if reused across other platforms. Enable two-factor authentication on all accounts as an additional security measure. Monitor financial statements and account activity for signs of unauthorized access or fraud. Report the phishing domain to the impersonated brand, manta, and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.