alabama[.]mobile-dsi[.]vip

On July 29 2026 analysts observed that the domain alabama.mobile-dsi.vip is actively used in a generic phishing campaign. The domain was registered on June 12 2026 through Gname.com Pte. Ltd. and is currently hosted on the IP address 172.67.148.143, which belongs to Cloudflare’s network. Its authoritative name servers are nataly.ns.cloudflare.com and cesar.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service for rapid changes or concealment of origin.

VirusTotal has recorded detections from ten of ninety‑one scanning engines, confirming that multiple security products consider the domain malicious. The domain also appears on a single public blocklist and has been listed by PhishDestroy, reinforcing its classification as a phishing resource. No additional public reputation scores or safe‑browsing verdicts are available at this time.

The short lifespan—created less than two months before the report—and the reliance on shared Cloudflare infrastructure are consistent with opportunistic phishing operators seeking disposable hosting. While the specific phishing lure (e.g., credential‑stealing page, credential‑verification flow) has not been captured, the presence of active detections and blocklist listings suggests that the domain is currently serving malicious content.

Defenders should block or sinkhole alabama.mobile-dsi.vip at the DNS level, monitor outbound connections to the associated IP address, and apply URL filtering rules that reference the observed blocklist entries and the PhishDestroy indicator set. Continuous passive DNS monitoring is advised to detect any future re‑resolution to alternative IP addresses, which is common for Cloudflare‑hosted phishing sites. Organizations that employ email security gateways should update phishing signatures to include this domain, and incident response teams should treat any user‑initiated connections to the domain as potentially compromised.