abaselama[.]org

Analysis of abaselama.org indicates a targeted brand impersonation campaign aimed at Facebook users. The domain was registered on June 07, 2024 through NameCheap, Inc., and currently resolves to the IP address 35.220.236.219, which is assigned to Google LLC (AS396982) and geolocated in Hong Kong. The authoritative name servers are ns1.dnsip.com and ns2.dnsip.com. The site presents a TLS certificate issued by Let’s Encrypt (R12), confirming that HTTPS is enabled, but the domain is presently taken offline, preventing live content inspection. The page title retrieved from historical snapshots reads "正规168极速赛车体彩1分钟查询-2025赛果168极速直播-赛车号码期开奖结果查询历史记录-Beauty®极速赛车168开奖官网开奖记录," a string of Chinese characters unrelated to Facebook, suggesting the domain may have been repurposed or used for multiple malicious payloads.

Google Safe Browsing flags the domain for social engineering, and eight of ninety‑five security vendors on VirusTotal have reported it as malicious. It appears on at least one public blocklist and has been specifically blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high confidence in its malicious nature. The known scam type is classified as social media phishing, consistent with the brand impersonation indicator.

Uncertainties remain regarding the exact phishing page layout, credential‑harvesting mechanisms, and whether any active command‑and‑control infrastructure is associated, because the site is offline and no HTTP response body is available for deeper analysis. Defenders should proactively block the domain and its resolving IP at perimeter firewalls and DNS filtering layers, monitor for re‑registration attempts, and add the domain to internal threat‑intel feeds. Continuous surveillance of related name‑server patterns (ns1.dnsip.com, ns2.dnsip.com) and Google‑owned IP ranges originating from Hong Kong may uncover future campaigns.