dash-uat[.]absa[.]one

This domain, dash-uat.absa.one, is identified as a fraudulent replica of the legitimate Absa Merchant Portal, designed to harvest login credentials from unsuspecting business users. Analysis indicates the site impersonates the official Absa banking portal, likely targeting merchants who process transactions through Absa’s payment systems. The fraudulent portal would capture entered credentials, enabling unauthorized access to sensitive financial accounts and transaction data, potentially leading to fraudulent transfers or data exfiltration. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 18, 2023, through 101domain GRS Limited, a registrar frequently associated with phishing domains. It resolves to the IP address 4.221.199.89, hosted on Microsoft Azure Cloud in South Africa (southafricanorth region). Security vendors on VirusTotal flagged the domain in 18 out of 95 scans, while one security blocklist, PhishDestroy, has already listed it as malicious. The SSL certificate, issued by Let’s Encrypt (serial E7), provides encryption but does not validate legitimacy, a common tactic in phishing operations to appear trustworthy. Users who accessed dash-uat.absa.one or entered credentials on the site should take immediate action to mitigate risk. All entered passwords and authentication details must be considered compromised and changed immediately on the legitimate Absa portal. Affected accounts should be reviewed for unauthorized transactions or configuration changes. Organizations should monitor for signs of lateral movement or follow-up attacks, such as targeted phishing emails or fraudulent payment requests. If financial data was exposed, contact Absa’s fraud response team to report the incident and request account monitoring. Network administrators should block the domain and associated IP (4.221.199.89) at the perimeter to prevent further access attempts.