main-sites[.]biz[.]id

Analysis indicates main-sites.biz.id is an infrastructure node associated with credential theft operations targeting user login portals. The domain exhibits patterns consistent with phishing kits designed to harvest authentication data, likely through spoofed landing pages delivered via proxied Cloudflare edge nodes. The use of distributed hosting complicates attribution while enabling rapid rotation before takedown.

Technical telemetry confirms the domain resolves to IP 104.21.3.180 under AS13335 (Cloudflare, Inc.), with SSL certificate identifier WE1. Domain creation date is February 21, 2026, indicating recent deployment consistent with short-lived malicious campaigns. VirusTotal reports 19/95 security vendors flagging the domain. Additionally, it appears on 1 security blocklist and is currently marked offline following enforcement actions.

If users interacted with this domain, credential compromise risk should be assumed. Immediate mitigation includes password resets for any reused credentials, enabling multi-factor authentication, and reviewing account access logs for anomalous sessions. Endpoint scans should be performed to detect potential token theft or browser session interception. Network defenders should block associated IP 104.21.3.180 and monitor for similar domains leveraging Cloudflare infrastructure and WE1 certificate patterns.