tabira[.]org

The domain tabira.org has been identified as an active credential theft phishing site, designed to harvest sensitive login credentials from unsuspecting users. Analysis indicates this infrastructure is currently operational, with no evidence of takedown or mitigation at the time of this report. The site employs social engineering tactics, as confirmed by its classification under SOCIAL_ENGINEERING by Google Safe Browsing, to deceive users into submitting authentication details. Infrastructure analysis reveals the domain was registered through IONOS SE on June 23, 2026, an unusually forward-dated creation that may indicate an attempt to evade detection or establish long-term persistence. It resolves to the IP address 65.181.120.97, which has been associated with other malicious activities in recent threat intelligence feeds. The domain is secured with a Let's Encrypt SSL certificate, a common tactic among threat actors to lend an appearance of legitimacy. Detection metrics further substantiate its malicious nature, with 18 of 95 security vendors on VirusTotal flagging the domain as malicious. Google Safe Browsing has explicitly classified it under SOCIAL_ENGINEERING, reinforcing its role in credential theft operations. Current status confirms tabira.org remains active and poses a high risk to users. Organizations and individuals are advised to implement immediate blocking measures for the domain and its associated IP address within network security controls. Endpoint protection solutions should be updated to include this domain in their blocklists, and users should be educated on recognizing social engineering tactics, particularly those involving fake login portals. Given the domain's recent registration and active status, continuous monitoring is recommended to track any shifts in infrastructure or additional malicious subdomains that may emerge. Incident response teams should treat any access to this domain as a potential security breach requiring investigation.