about-paybabln[.]com

PhishDestroy identifies about-paybabln.com as an active generic phishing domain hosting a credential-stealing login page. The threat is currently classified as elevated, with confirmed malicious activity targeting unsuspecting users.

This domain was flagged by 20 of 95 VirusTotal security vendors, registered through Aceville Pte. Ltd. using IP address 34.59.11.196. The domain was created on April 29, 2026, and appears on two public blocklists, including OpenPhish and PhishingArmy. Its SSL certificate, issued by TrustAsia Technologies, Inc., further suggests an attempt to appear legitimate. With a VirusTotal detection ratio of 21% and presence on two blocklists, this domain exhibits clear malicious indicators consistent with phishing infrastructure.

While the domain remains active as of this advisory, immediate action is required to mitigate risk. Users are advised to avoid interacting with this domain entirely. Organizations should update firewall rules, DNS sinkholes, and proxy filters to block traffic to about-paybabln.com and its associated IP. Security teams should also conduct endpoint scans to detect any potential compromise from prior exposure. PhishDestroy continues to monitor for changes in infrastructure or additional IOCs.