pemulihan-akun[.]costom[.]web[.]id

On July 19, 2026 analysts observed that the domain pemulihan-akun.costom.web.id remains active and resolves to the IP address 104.21.22.23. Google Safe Browsing has flagged the domain for social engineering, indicating that it is being used to lure users into credential‑stealing activities. A VirusTotal scan shows that 16 of 95 security vendors label the domain as malicious, reinforcing the suspicion of a phishing operation. Infrastructure analysis reveals that the domain’s nameserver information is not available (NS_NOT_FOUND), and the resolved IP belongs to a large content‑delivery network, suggesting the use of a shared hosting service to obscure the attacker’s true location. The domain appears on one external security blocklist and is already blocked by the PhishDestroy service, which provides additional confidence in its malicious nature. Current intelligence does not include details about the specific phishing lure, targeted brands, or underlying malware kit, leaving those aspects uncertain. Defenders should immediately block the domain at DNS and firewall layers, monitor for outbound connections to the associated IP address, and incorporate the domain into local and cloud‑based threat‑intel feeds. Continuous re‑assessment is advised, as changes to the hosting infrastructure or additional detections could alter the risk profile.