gajahbesar[.]xyz

The domain gajahbesar.xyz is currently offline but has been flagged as malicious by 4 out of 92 vendors on VirusTotal. It was registered through Namecheap and hosted on a CloudFlare IP address located in Canada. Despite its offline status, it has been included in one public blocklist, specifically by PhishDestroy.

This domain was likely involved in phishing activities, exploiting its brief active period to target unsuspecting users. The SSL certificate was issued by Let's Encrypt, a common choice for phishing domains due to its free and automated nature. The use of CloudFlare for hosting indicates an attempt to mask the origin server's IP and possibly leverage CloudFlare's security features to prolong the domain's lifespan.

The fact that gajahbesar.xyz is now offline suggests that either the phishing campaign was short-lived or the domain was taken down due to detection and reporting. The presence of the domain on PhishDestroy's blocklist underscores its malicious intent, even though it is no longer active. This case highlights the importance of rapid detection and response to phishing threats, as domains can quickly go offline after achieving their malicious objectives.