alabama[.]mobile-aye[.]vip

Analysis of alabama.mobile-aye.vip shows a newly registered domain that is actively being used for malicious purposes. The domain was created on June 12, 2026 and is registered through Gname.com Pte. Ltd. It resolves to the IP address 172.67.173.238, an address associated with a large content‑delivery network, which can obscure the true hosting location and aid rapid redeployment. VirusTotal reports that nine out of ninety‑one security vendors have flagged the domain, indicating a consensus among multiple detection engines that the site exhibits malicious behavior.

Independent threat‑intelligence feeds have added the domain to a security blocklist, and the commercial anti‑phishing service PhishDestroy has confirmed that it is being blocked. The risk rating is elevated and the operational status is listed as active, suggesting ongoing campaign activity. No public page title, SSL certificate details, or HTTP response codes are currently available, leaving the exact content and delivery mechanisms unverified.

Consequently, defenders lack visibility into the specific phishing lure or credential‑stealing technique employed. Given the observed vendor detections, blocklist inclusion, and active blocking by PhishDestroy, the prudent response is to deny resolution of the domain at the network perimeter, add the IP address to any existing deny lists, and monitor DNS queries for related sub‑domains. Continuous re‑evaluation is advised as additional telemetry becomes available, particularly any observed payloads, landing‑page characteristics, or victim reports.