alabama[.]mobile-wkl[.]vip

This domain, alabama.mobile-wkl.vip, is identified as a generic phishing site designed to harvest user login credentials through deceptive login portals. Analysis indicates it mimics legitimate authentication pages to trick victims into submitting usernames, passwords, and potentially multi-factor authentication codes. The domain does not host malware directly but facilitates account compromise, which may lead to unauthorized access, data exfiltration, or downstream attacks such as financial fraud or corporate espionage. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. VirusTotal detection data shows 7 out of 95 security vendors flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain's malicious intent. The domain is currently offline, reducing immediate risk but not eliminating the potential for future reactivation or rebranding under a similar naming scheme. Users who visited alabama.mobile-wkl.vip should assume their credentials were compromised. Immediate actions include resetting passwords for any accounts accessed while on the site, enabling multi-factor authentication where available, and monitoring associated accounts for unauthorized activity. System scans using updated security tools are recommended to detect any secondary payloads or browser-based persistence mechanisms. Organizations should review logs for connections to this domain and assess whether corporate credentials were exposed. If financial or sensitive data was entered, credit monitoring and fraud alerts should be considered.