abrmot[.]pro

This domain, abrmot.pro, is flagged as a high-risk credential theft operation. Analysis indicates the infrastructure is designed to harvest user login credentials through deceptive landing pages, likely mimicking legitimate authentication portals. No direct association with a specific brand or drainer kit has been confirmed, though the domain’s structure and behavior align with credential harvesting campaigns targeting financial or corporate accounts. Infrastructure analysis reveals the following technical indicators: the domain was registered on July 8, 2026, through Global Domain Group LLC and currently resolves to the IP address 188.114.97.3. Security vendor assessments on VirusTotal show 16 out of 95 detections, while the domain appears on one security blocklist. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious sites. No Google Safe Browsing (GSB) flags were reported at the time of analysis. The domain remains active and unresolved by the registrar, posing an ongoing risk to users. While some security filters, including Hagezi, have blocked access, the infrastructure’s persistence suggests continued targeting. Organizations and individuals are advised to implement DNS-level blocking for 188.114.97.3 and monitor for related subdomains or redirects. Users should verify authentication portals independently and avoid entering credentials on untrusted sites, even if they appear secure.