alabama[.]mobile-kwa[.]vip

This domain is flagged for credential harvesting phishing, a threat type designed to deceive users into submitting sensitive authentication details via fraudulent login interfaces. The risk level is classified as elevated due to confirmed malicious infrastructure and active security vendor detections, though the domain is currently offline. Analysis indicates the domain alabama.mobile-kwa.vip was registered through Gname.com Pte. Ltd. on June 12, 2026, an anomalous future date suggesting registry manipulation or data obfuscation. It resolves to IP address 172.67.194.157, a hosting provider often associated with malicious campaigns. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while a single security blocklist has incorporated it into their filtering rules. The SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently leveraged by threat actors to lend false credibility to phishing pages. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (172.67.194.157) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) into endpoint detection and response (EDR) systems, including the domain, IP, and SSL certificate thumbprint for retrospective hunting. User awareness training should emphasize recognizing phishing tactics, particularly those mimicking mobile authentication portals. Additionally, organizations should monitor for anomalous login attempts or credential reuse stemming from this campaign, as harvested credentials may be exploited in follow-on attacks.