warungnokos[.]web[.]id

The domain warungnokos.web.id was registered on 2026-03-02 through PT JC Indonesia and resolves to the IPv4 address 195.88.211.226, an Indonesian hosting provider (ArenHost). The site presents the page title “Warung Nokos — Penyedia Nomor Virtual Tercepat Se Indonesia.” It is currently reachable over HTTPS using a Let’s Encrypt R13 certificate and returns HTTP 200 for the root request. The domain is listed on a public phishing blocklist (PhishDestroy) and appears in one AlienVault OTX pulse. Infrastructure-level indicators include a Gridinsoft trust score of 0 / 100 and inclusion on a single security blocklist. The domain’s MX record points to the same host (warungnokos.web.id), a pattern often observed in phishing deployments. VirusTotal reports that the site has been scanned by 94 AV engines without any detections; the lack of detections does not imply benign intent. No additional payload or content analysis is available at the time of this report, leaving the exact phishing payload unknown. Given the confirmed blocklist listings, the phishing‑related page title, and the low trust rating, defenders should treat the domain as malicious, enforce network-level blocking, and monitor DNS queries for related subdomains. Ongoing observation is recommended to capture any evolving tactics.