alabama[.]mobile-gkj[.]vip

This assessment concerns the domain alabama.mobile-gkj.vip, classified under generic_phishing with an elevated risk level. The infrastructure demonstrates characteristics consistent with credential harvesting or deceptive login redirection patterns, typically used in broad-scope phishing campaigns targeting user authentication data. The domain was identified as part of a disposable subdomain structure likely intended for rapid deployment and rotation.

Technical intelligence indicates the domain was created on June 12, 2026 and registered via Gname.com Pte. Ltd. DNS resolution points to IP address 188.114.97.3, suggesting hosting on shared infrastructure commonly used in transient web operations. Security telemetry reports a 9/95 detection ratio across scanning engines, alongside 1 confirmed security blocklist entry. The SSL certificate issuer is Google Trust Services, which may be leveraged to increase perceived legitimacy despite malicious intent.

At the time of analysis, the domain is confirmed offline, reducing immediate exposure to end users. However, historical activity and detection signals confirm its role in phishing operations prior to takedown. Given the use of reusable subdomain patterns and externally hosted IP infrastructure, residual risk remains in the form of potential reactivation, cloning, or reuse of the same phishing kit. Continuous monitoring of related domains and IP ranges is recommended, along with preventive blocking of similar patterns to mitigate re-emergence threats.