mrab5[.]cc

This domain, mrab5.cc, is flagged as a generic phishing site with a captcha-themed page. Analysis indicates no association with a specific brand or known phishing kit, suggesting a broad-target campaign designed to harvest credentials or distribute malware under the guise of a verification challenge. The page title, 'Captcha,' aligns with common social engineering tactics to lower user suspicion by mimicking legitimate security prompts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3, a Cloudflare-hosted endpoint, and employs technologies including Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Let's Encrypt. Detection metrics show 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The Gridinsoft trust score is 0/100, further confirming its malicious classification. As of the latest assessment, mrab5.cc has been taken offline, and the domain is no longer resolving. However, the elevated risk level persists due to the domain's recent activity and the potential for re-emergence under altered infrastructure. Organizations should monitor for related indicators, including the IP 188.114.96.3 and the registrar's namespace. Network-level blocking of the domain and associated IP is recommended as a precautionary measure. Users who may have interacted with the site should verify their credentials and scan for potential malware exposure.