abal[.]my

Analysis of the domain abal.my, observed on July 20, 2026, indicates active malicious infrastructure targeting credential harvesting. The domain was registered through Dynadot, LLC on June 20, 2026 and is authoritative on the Cloudflare nameservers eugene.ns.cloudflare.com and sarah.ns.cloudflare.com. DNS resolution points to the IP address 185.53.179.146, which is currently listed on one public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. VirusTotal scans show that nine of ninety‑five antivirus and URL‑reputation engines flag the domain as malicious, reinforcing the suspicion of phishing use. No additional public intelligence such as Safe Browsing status, OTX mentions, SSL certificate details, HTTP response codes, or page title information is presently available, leaving the exact payload and lure mechanisms undocumented. The limited detection surface suggests a short‑lived campaign that relies on fast‑flux domain registration and cloud‑based DNS to evade takedown. Defenders should add abal.my to domain and IP blocklists, monitor traffic to 185.53.179.146 for anomalous authentication attempts, and employ DNS‑sinkholing where possible. Continuous re‑scanning with multi‑vendor services is recommended to capture any evolution of the threat, and any future observations of page content or credential‑stealing kits should be incorporated into threat‑intel feeds to improve detection accuracy.