qtm[.]pbv[.]name[.]ng

The domain qtm.pbv.name.ng has been identified as a credential theft scam site and is currently offline. It impersonates a market platform, likely aiming to trick users into divulging sensitive information such as login credentials or financial details.

Analysis indicates that qtm.pbv.name.ng was flagged by 3 out of 95 VirusTotal vendors, suggesting a limited but significant level of detection. The domain was registered through Reservedomain (NAR) and resolves to the IP address 167.235.14.117. It appeared on one security blocklist and used a Let's Encrypt SSL certificate, which is common among phishing sites to appear more legitimate. The site employed technologies such as PHP, LiteSpeed, Cloudflare, Smartsupp, and cdnjs, and supported HTTP/3. These technologies can facilitate faster and more robust malicious activities. The page title 'Quantremarkets - Market Platform' further supports the notion of brand impersonation, potentially targeting users of a legitimate financial platform.

Given the current offline status of the domain, the immediate threat has been mitigated. However, it is recommended that organizations and individuals who may have interacted with this domain conduct a thorough review of their credentials and financial accounts for any unauthorized activity. Network administrators should ensure that this domain is blocked in their security policies and consider implementing additional layers of defense, such as multi-factor authentication, to protect against similar attacks. Users are advised to remain vigilant and verify the authenticity of any financial or market-related websites before entering sensitive information.