alabama[.]mobile-gae[.]vip

The domain alabama.mobile-gae.vip has been identified as a fake mobile login phishing site designed to harvest user credentials. Analysis indicates the domain is currently offline, though it previously posed an elevated risk to unsuspecting visitors attempting to access mobile services. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential-theft campaigns targeting generic mobile login portals. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with phishing operations. It resolves to the IP address 188.114.97.3 and is flagged by 10 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain appears on one security blocklist, further corroborating its malicious classification. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to potential victims. As of the latest assessment, alabama.mobile-gae.vip has been taken offline, reducing immediate exposure. However, organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for similar domains registered under Gname.com or resolving to the same IP range. End-users should exercise caution when encountering unsolicited mobile login prompts and verify domain authenticity before entering credentials.