freelanceakunkerja[.]com

The domain freelanceakunkerja.com has been identified as a credential theft site designed to impersonate legitimate freelance work platforms. Analysis indicates this domain was actively used to harvest user login credentials, personal information, and payment details from individuals seeking remote employment opportunities. As of the latest assessment, the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Infrastructure analysis reveals the domain was registered on April 14, 2026, through NameMart Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.178.208, hosted by a content delivery network provider in Canada, which is consistent with tactics used to obscure the true origin of malicious infrastructure. The domain was flagged by 23 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious classification. Additionally, it appeared on one security blocklist and was proactively blocked by at least one threat intelligence feed. The SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to mimic legitimate encryption practices to evade detection. Current status confirms the domain is offline, though historical exposure may persist for affected users. Organizations and individuals are advised to monitor for unauthorized access to accounts linked to freelance platforms, particularly those accessed during the domain's active period. Users who entered credentials on this site should immediately reset passwords, enable multi-factor authentication, and review financial transactions for signs of compromise. Network administrators are recommended to block the domain and associated IP address in perimeter defenses to prevent potential re-emergence or residual traffic. Ongoing vigilance is warranted, as threat actors frequently repurpose infrastructure for subsequent campaigns.