alabama[.]mobile-ctw[.]vip

The domain alabama.mobile-ctw.vip was created on June 12, 2026 and is registered through Gname.com Pte. Ltd. DNS queries resolve the name to the IPv4 address 172.67.128.164, which belongs to Cloudflare’s global edge network. Cloudflare hosting does not by itself indicate malicious intent, but the recent registration date aligns with the typical lifecycle of phishing infrastructure that is deployed for short‑term campaigns. VirusTotal analysis shows that 12 of 91 scanned security vendors flag the domain as malicious, providing independent confirmation of suspicious activity.

The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for phishing. The current risk level is elevated and the status is active, indicating that the infrastructure is still operational. No publicly available page title, SSL certificate details, or HTTP response codes have been disclosed, so content‑level characteristics remain unknown.

Defenders should add alabama.mobile-ctw.vip to URL filtering and DNS‑based block lists, monitor traffic to the associated IP 172.67.128.164 for anomalous connections, and share the indicator with threat‑intelligence platforms to improve collective detection. Continuous re‑evaluation is advised in case additional evidence, such as page content or credential‑harvesting behavior, becomes available.