ab3[.]cc

ab3.cc has been identified as a high‑risk generic phishing infrastructure. The domain was registered on March 28 2026 through Tucows Domains Inc. and currently resolves to the IP address 66.96.144.171, which is assigned to Newfold Digital, Inc. in the United States. The authoritative name servers are ns1.easy‑cgi.com and ns2.easy‑cgi.com, and the site presents an HTTP 403 response with no TLS certificate in place.

Open Threat Exchange (OTX) reports the domain in a single threat‑intel pulse, and PhishDestroy already lists it as blocked. VirusTotal analysis shows that 7 of 95 scanned security engines flag the domain, reflecting a modest detection rate but reinforcing its malicious reputation. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public blocklist, indicating consensus among defensive feeds.

The lack of an SSL certificate and the immediate 403 response suggest a deliberately restrictive web server configuration, possibly to impede automated crawling while still delivering malicious payloads through other channels such as email or redirected links. The use of easy‑cgi.com name servers is common among disposable or rapidly provisioned hosting, and the IP belongs to a provider known for hosting transient web assets, further supporting a short‑lived attack model.

Defenders should add 66.96.144.171 and the hostnames ns1.easy‑cgi.com / ns2.easy‑cgi.com to network‑level deny lists, and enforce DNS filtering for the domain ab3.cc. Continuous monitoring of OTX and other threat‑intel platforms for new pulses is advised, as the campaign may evolve or spawn additional infrastructure. Given the high‑risk classification, organizations handling credential‑sensitive traffic should treat any encounter with this domain as malicious and block it outright.