alabama[.]mobile-fbf[.]vip

This domain, alabama.mobile-fbf.vip, is flagged as a generic phishing site designed to harvest user credentials through fake login portals. Analysis indicates no direct association with known brand impersonation or crypto drainer kits, but the infrastructure aligns with credential theft campaigns targeting mobile users. The domain mimics legitimate login flows, likely leveraging social engineering to deceive victims into submitting sensitive information such as usernames, passwords, or multi-factor authentication codes.

Technical indicators confirm elevated risk: the domain is detected by 9 out of 95 security vendors on VirusTotal, registered through Gname.com Pte. Ltd. on June 12, 2026, and resolves to IP address 172.67.135.190. It appears on a single security blocklist and is currently offline, though its SSL certificate was issued by Google Trust Services. The creation date suggests recent deployment, and the domain’s infrastructure exhibits characteristics typical of short-lived phishing operations.

Current status is offline, reducing immediate exposure, but residual risk persists due to potential reactivation or reuse of the domain’s infrastructure. Response actions should include monitoring for re-emergence, blocking the IP and domain across network defenses, and alerting users who may have interacted with the site. Organizations are advised to review logs for connections to 172.67.135.190 and implement additional authentication safeguards for accounts potentially exposed to this campaign.