dabaf[.]com

This domain is flagged as a high-risk phishing portal designed to harvest user credentials through fake login interfaces. Analysis indicates the site mimics legitimate authentication pages, tricking visitors into submitting sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is optimized for rapid deployment and evasion, with minimal branding to avoid immediate detection by automated scanners. Given the generic page title and lack of legitimate content, the site likely serves as a template for credential theft campaigns targeting multiple brands or services. Infrastructure analysis reveals concrete indicators of malicious activity. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-volume phishing operations. It resolves to the IP address 185.50.70.108, hosted on AS208425 (Osbil Technology Ltd), a network with a history of abuse. Security vendors on VirusTotal flag the domain at a rate of 17/95, while it appears on at least one blocklist and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate, issued by a widely trusted provider, is used to lend a false sense of legitimacy to the fraudulent site. Users who visited dabaf.com or entered credentials on the site should take immediate action to mitigate risk. All submitted login details must be considered compromised and should be changed across any other platforms where the same credentials were reused. Enable multi-factor authentication on critical accounts to prevent unauthorized access. Monitor financial and communication accounts for signs of unauthorized activity, such as unexpected password reset emails or unfamiliar transactions. If the site was accessed via a corporate or institutional device, report the incident to internal security teams for further investigation and containment.