abacusonionmarket[.]org

This domain, abacusonionmarket.org, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis confirms the domain is currently offline, though it previously hosted active phishing infrastructure designed to capture sensitive authentication details. Infrastructure analysis reveals the domain was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated registration that may suggest domain spoofing or typosquatting tactics. The domain resolved to the IP address 188.114.97.3, which has been associated with other malicious activities. It appears on one security blocklist and holds a trust score of 0 out of 100, further corroborating its malicious classification. AlienVault OTX records the domain in one threat intelligence pulse, suggesting limited but confirmed tracking by security communities. Despite its current offline status, abacusonionmarket.org remains a documented threat. Organizations are advised to proactively block the domain and its associated IP address at the network perimeter. Security teams should monitor for any signs of reactivation or re-registration under similar naming conventions. Endpoint protection systems should be updated to include this domain in phishing detection rules, and users should be educated to recognize credential harvesting attempts, particularly those mimicking financial or marketplace services.