albato[.]guru

Analysis of the domain albato.guru indicates active credential phishing infrastructure as of July 12, 2026. The domain was registered on February 21, 2026, through Dynadot LLC, a registrar frequently observed in phishing campaigns. It resolves to the IP address 54.215.31.113, hosted on Amazon Web Services (AS16509) in the United States. The domain employs Cloudflare for content delivery and protection, a common tactic to evade detection and analysis. Additional technologies detected include Highcharts, Bootstrap, jQuery, HSTS enforcement, and Google Analytics, suggesting a structured and potentially deceptive user interface designed to harvest credentials. The domain is flagged by one threat intelligence pulse in AlienVault OTX and appears on a single security blocklist, with PhishDestroy currently blocking access. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. Sixteen of 93 security vendors on VirusTotal detect this domain as malicious, though the specific detection rules and methodologies remain unconfirmed. The domain's nameservers, ns1.dyna-ns.net and ns2.dyna-ns.net, are consistent with infrastructure previously associated with phishing operations. The page title, 'For Sale Domain: albato.guru,' does not align with the domain's observed malicious activity, indicating a possible attempt to mislead automated detection systems or analysts. The HTTP 302 redirect further suggests dynamic behavior, potentially rerouting victims to credential harvesting pages. While the exact target brand or service remains unconfirmed, the domain is explicitly categorized as a credential phishing site based on available intelligence. Defenders are advised to block the domain at the DNS or proxy level, monitor for connections to the IP 54.215.31.113, and review logs for any interaction with albato.guru or its associated infrastructure.