mab-ci[.]com

The domain mab-ci.com is a generic phishing site posing no specific brand impersonation or crypto drainer functionality. As of the latest verification, mab-ci.com has been taken offline, but it previously operated as an elevated-risk phishing page targeting users with fraudulent login or credential harvesting schemes. No legitimate service or organization is associated with this domain, and users should treat any prior interaction with it as a potential security compromise.

Technical analysis of mab-ci.com reveals 3 of 95 VirusTotal security vendors flagged the domain as malicious, including alphaMountain.ai, Forcepoint ThreatSeeker, and Webroot. The domain was registered through ENOM, INC. on March 31, 2021, and resolved to the IP address 5.161.109.243, hosted by Hetzner Online GmbH in the US. It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Let's Encrypt (R12). The observed page title was 'AcuGIS | Holding Page', and technologies detected included Bootstrap and Apache HTTP Server. Google Safe Browsing did not flag the domain at the time of assessment.

Users who may have interacted with mab-ci.com should immediately change any passwords entered on the site, particularly if reused across other platforms. Enable two-factor authentication (2FA) on all critical accounts to mitigate further risk. Monitor financial and login activity for signs of fraud or unauthorized access. Report the domain to relevant authorities or security organizations, such as the Anti-Phishing Working Group (APWG) or local cybercrime units, to aid in broader threat mitigation efforts.