bersatu[.]me

This domain is flagged as a credential harvesting site. The domain bersatu.me resolves to the IP address 188.114.97.3 and is hosted on Cloudflare DNS, as indicated by the authoritative nameservers patryk.ns.cloudflare.com and sofia.ns.cloudflare.com. Registration data show the domain was created on March 01, 2025 and was registered through Namecheap Inc. The domain currently remains active. Threat intelligence indicates that bersatu.me appears on a single security blocklist and is explicitly blocked by the PhishDestroy service.

VirusTotal analysis has recorded 16 of 91 security vendors flagging the domain as malicious, providing corroborating evidence of its abusive intent. No additional public attributes such as page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current dataset, leaving those aspects unverified. Defenders should treat the domain as high‑risk and proactively block it at the DNS level, add the associated IP address 188.114.97.3 to network deny lists, and monitor for any outbound connections to the host. Continuous re‑evaluation is advised, as further content analysis may reveal additional indicators of compromise.

Logging of DNS queries for bersatu.me and correlation with user authentication attempts can help detect credential leakage attempts. Organizations employing email security gateways should ensure that messages containing links to this domain are quarantined or rejected, and incident response teams should be prepared to investigate any reported exposures linked to the domain. Sharing of indicators with industry threat‑sharing platforms is also recommended to improve collective defense.