perbaiika4n-akun-danaa[.]resmi-akzz3[.]my[.]id

PhishDestroy identifies perbaiika4n-akun-danaa.resmi-akzz3.my.id as an active crypto drainer domain posing as a legitimate login portal, designed to steal cryptocurrency assets. The domain employs deceptive subdomain structures (resmi-akzz3.my.id) to mimic official regional or language-specific services, increasing credibility for unsuspecting users. This threat falls under the generic phishing category but specifically targets cryptocurrency holders through fake authentication gateways, likely harvesting credentials or directly draining wallet funds via embedded drainer scripts.

This domain was flagged by 11 out of 95 security vendors on VirusTotal, indicating elevated detection but not universal consensus. It resolves to IP address 172.67.160.251 via Cloudflare infrastructure, leveraging Google Trust Services for SSL certification to appear legitimate. The domain uses the .my.id ccTLD, registered through a privacy-protected registrar, with no public creation date available—suggesting recent registration to evade historical blocklists. Google Safe Browsing (GSB) has not yet flagged this domain, and it currently appears on 3 public blocklists, including PhishDestroy’s seed 4d9ca8. The absence of prior reputation and reliance on Cloudflare suggests opportunistic deployment rather than sustained infrastructure.

As of the latest scan, perbaiika4n-akun-danaa.resmi-akzz3.my.id remains active with an elevated risk status. Immediate response actions include blocking the domain and IP at the network perimeter, updating DNS sinkholes, and flagging the SSL certificate for revocation review. The remaining risk is moderate due to partial vendor detection and lack of GSB classification, indicating potential for continued operation until broader consensus is achieved. Users are advised to avoid interaction, verify any similar domains using PhishDestroy’s real-time scanner, and report incidents to enhance collective threat intelligence.