jingga888-indobalitour-contact-us[.]pages[.]dev

The domain jingga888-indobalitour-contact-us.pages.dev is currently active and operates as a credential theft scam targeting users of online gambling platforms. Analysis of the page title, 'Jingga888 Slot Meta Platforms: Teknologi Interaktif, Login Lebih Stabil,' suggests an attempt to impersonate a legitimate slot gaming service to harvest login credentials. The domain is not associated with any known legitimate brand but mimics the style and terminology of regional gambling platforms, increasing the likelihood of deception among targeted users. Infrastructure analysis reveals the domain was registered on December 13, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.46.224, hosted under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors leveraging free or low-cost hosting services. The domain appears on one security blocklist and is flagged by 2 of 95 security vendors on VirusTotal, indicating early detection but limited widespread recognition. The use of Cloudflare's infrastructure provides the attacker with anonymity and resilience against takedown efforts. Current status remains active, posing a high risk to users who may be lured into entering sensitive credentials. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include the IP address 172.66.46.224. Users should be educated on recognizing phishing indicators, such as mismatched URLs, unsolicited login prompts, and domains registered through free hosting services. Monitoring for similar domains using the 'jingga888' or 'indobalitour' naming conventions is recommended to preempt further credential theft attempts.