# PhishDestroy domain threat record: menuuu-aktivasi.kruer.web.id Content language: English Canonical HTML report: https://phishdestroy.io/domain/menuuu-aktivasi.kruer.web.id/ Machine-readable companion: https://phishdestroy.io/domain/menuuu-aktivasi.kruer.web.id/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-19 01:30:47 UTC - Last availability or vendor check: 2026-10-21 22:32:51 UTC - Stored record updated: 2026-10-22 14:23:19 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: flagged ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registration date (registry RDAP, web.id): 2011-11-25 13:29:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a151d5-64d5-72eb-a689-1a95de5c8194/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/menuuu-aktivasi.kruer.web.id - Certificate Transparency search: https://crt.sh/?q=%25.menuuu-aktivasi.kruer.web.id - Web Archive lookup: https://web.archive.org/web/*/https://menuuu-aktivasi.kruer.web.id/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy has listed menuuu-aktivasi.kruer.web.id as a suspicious domain. The recorded page title is “Gopay”. The domain was first seen by PhishDestroy on 2026-10-19. An HTTP 200 response was recorded on that date. How the scam works The current evidence does not point to a particular fraud technique. A page title referencing a popular payment service may be used to lure users into entering credentials or personal data, but no concrete behavior was observed. Evidence VirusTotal scanned the site on 2026-10-19 and reported 5 detections out of 92 engines, including AlphaMountain.ai, Fortinet, LevelBlue, SOCRadar and Webroot. Google Safe Browsing flagged the domain as social engineering on 2026-10-19. urlscan’s analysis on the same day marked it as not malicious. No external blocklists listed the domain (count 0) as of 2026-10-19, while PhishDestroy’s internal list includes it. Spamhaus DBL showed no listing and OTX had zero pulses on that date. Infrastructure The recorded IP address is 188.114.97.3, which belongs to the Cloudflare network (CLOUDFLARENET – Cloudflare, Inc., US). The TLS certificate presented on 2026-10-19 was issued by Let’s Encrypt / YE2. What to do If you visited the site and entered any login or payment credentials, change those credentials immediately and monitor accounts for unauthorized activity. Do not approve any requests from unknown services. Security teams should block the exact domain, log any connections, and review related traffic for signs of credential harvesting. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a151d5-64d5-72eb-a689-1a95de5c8194/ VirusTotal report: https://www.virustotal.com/gui/domain/menuuu-aktivasi.kruer.web.id Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=menuuu-aktivasi.kruer.web.id Archived copy: https://web.archive.org/web/20261019014256/https://menuuu-aktivasi.kruer.web.id/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 20:04:36 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Xr81KpRH/7b76f69c4bfd.png Captured: 2026-10-19 01:46:20 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a151d5-64d5-72eb-a689-1a95de5c8194.png Captured: 2026-10-19 01:46:20 UTC Source report: https://urlscan.io/result/01a151d5-64d5-72eb-a689-1a95de5c8194/ - URLScan capture 2: https://urlscan.io/screenshots/01a151ac-5388-7388-9f52-69eb7a1d15dc.png Captured: 2026-10-19 01:30:47 UTC Source report: https://urlscan.io/result/01a151d5-64d5-72eb-a689-1a95de5c8194/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d558a569-31c0-4803-a5f9-1f9f97510fd1.png Captured: 2026-10-19 01:36:45 UTC Source report: https://radar.cloudflare.com/scan/d558a569-31c0-4803-a5f9-1f9f97510fd1 SHA-256: f1b78c15d650114ccd8c7a1bf39f3e4889e1fedc70522b4e01c6094493dc6d1b - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151ac-5388-7388-9f52-69eb7a1d15dc.png Captured: 2026-10-19 01:00:22 UTC Source report: https://urlscan.io/result/01a151ac-5388-7388-9f52-69eb7a1d15dc/ SHA-256: 7b82a83f0c80d59c30aaa722af687b0faae5071e7212acdda4beec37e5183fe5 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151ed-b86c-7354-9cd7-13954dc17eb2.png Captured: 2026-10-19 02:11:43 UTC Source report: https://urlscan.io/result/01a151ed-b86c-7354-9cd7-13954dc17eb2/ SHA-256: 92642a4cc61e590565ae50952c3879be44c45f3713bc40d0ec74fa0eb24670af ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T16:44:38Z", "uuid": "01a151d5-64d5-72eb-a689-1a95de5c8194", "scanned_at": "2026-10-19T01:45:09Z", "final_url": "https://menuuu-aktivasi.kruer.web.id/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://menuuu-aktivasi.kruer.web.id/", "from": "http://menuuu-aktivasi.kruer.web.id/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "owlcarousel2.github.io", "d2v6npc8wmnkqk.cloudfront.net", "lelogama.go-jek.com", "fonts.gstatic.com", "static.cloudflareinsights.com", "ambil-hadiah10jtresmi4dana.pages.dev", "www.image2url.com", "www.findaya.co.id", "www.julo.co.id", "antinomi.org", "fonts.googleapis.com", "cdnjs.cloudflare.com" ], "ips": [ "142.251.20.94", "2606:4700::6810:5049", "188.114.96.3", "2600:9000:223d:f000:2:ec67:af00:21", "43.173.31.137", "147.139.195.54", "34.117.236.210", "153.92.13.126", "2606:50c0:8001::153", "2a00:1450:4001:c13::5f", "104.17.25.14", "188.114.97.3" ], "asns": [ "15169", "13335", "16509", "132203", "45102", "396982", "47583", "54113" ], "countries": [ "US", "ID", "DE" ], "doc_hash": "aab9a4082ccf3d09e438d86eec8011dfb1e406d4e82cf37f3c9a020929e7f13f", "globals": [ "$", "jQuery", "letsgo", "__cfBeacon" ], "tls": { "san": [ "*.kruer.web.id", "kruer.web.id" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "kruer.web.id", "protocol": "QUIC", "valid_to": "2027-01-05T06:53:06Z", "valid_from": "2026-10-07T06:53:07Z" }, "domain_age_days": 0, "apex_age_days": 11, "tls_age_days": 11, "tls_valid_days": 89, "requests": 19, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:56:01Z", "uuid": "d558a569-31c0-4803-a5f9-1f9f97510fd1", "scanned_at": "2026-10-19T01:36:45Z", "final_url": "https://menuuu-aktivasi.kruer.web.id/", "status": 200, "history": [ { "url": "https://menuuu-aktivasi.kruer.web.id/", "status": 200 } ], "dom_hash": "51a22d57628457f29dd34bf91802794b903d43cc2292aca4420407527cc28f68", "doc_hash": "7e48e40bc742c89dea22debbd36f8771b53f521b9f5e25acb3bd75fb2bf7d600", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "menuuu-aktivasi.kruer.web.id", "type": "A", "value": "104.21.70.228" }, { "name": "menuuu-aktivasi.kruer.web.id", "type": "A", "value": "172.67.140.42" }, { "name": "menuuu-aktivasi.kruer.web.id", "type": "AAAA", "value": "2606:4700:3035::ac43:8c2a" }, { "name": "menuuu-aktivasi.kruer.web.id", "type": "AAAA", "value": "2606:4700:3037::6815:46e4" } ], "dnssec_valid": false, "ip": "104.21.70.228", "whois": { "registrar": "PT JC Indonesia", "nameservers": [ "elly.ns.cloudflare.com", "max.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T18:07:08Z", "analysis_at": "2026-10-19T00:32:24Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 4, "suspicious": 1, "undetected": 35 }, "detections": { "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "suspicious", "LevelBlue": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "tags": [ "dga" ], "first_seen": "2026-10-18T05:43:23Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:46e4" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:8c2a" }, { "ttl": 300, "type": "A", "value": "104.21.70.228" }, { "ttl": 300, "type": "A", "value": "172.67.140.42" } ], "dns_at": "2026-10-19T00:38:40Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.kruer.web.id", "kruer.web.id" ], "issuer": "Let's Encrypt / YE2", "serial": "5a0d2ec8c91dcac9cf716178b57d017f37f", "sha256": "abc8efa7883c3f652075f72a039467f35265f1fca19ffb530a4f5440e61446be", "subject": "kruer.web.id", "valid_to": "2027-01-05T06:53:06Z", "valid_from": "2026-10-07T06:53:07Z" } } } ```