test-abcaa-2[.]com

This domain, test-abcaa-2.com, was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers are emma.ns.cloudflare.com and jack.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s network. DNS resolution points to IP address 104.21.90.141, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed, so connections to the site would have been unencrypted. The only visible page element is the title “test-abcaa-2.com/”, and no further content has been captured. VirusTotal analysis recorded four positive detections out of ninety‑three scanners, and the domain appears on one public blocklist. The PhishDestroy blocklist also lists the domain. As of the report date, 25 July 2026, the site is reported as taken offline.

Analysis indicates that the domain is being used for a generic phishing campaign, although the specific target, lure, or credential‑stealing mechanism has not been disclosed in the available data. The lack of an SSL certificate, combined with multiple security vendor detections and inclusion on blocklists, suggests malicious intent. The exact phishing landing page, credential harvesting method, and any associated command‑and‑control servers have not been observed, leaving those aspects uncertain.

Defenders should block any outbound connections to 104.21.90.141 and add test-abcaa-2.com to local deny lists. Monitoring of Cloudflare‑hosted IP ranges for similar newly‑registered domains can help identify related infrastructure. Because the domain is already offline, immediate remediation focuses on preventing re‑use of the same infrastructure and ensuring that any cached references are purged from internal security tools. Retrieval of archived snapshots, if available, may provide additional context for the phishing payload.