frr[.]ambil-disini[.]web[.]id

Analysis as of July 19, 2026 indicates that the domain frr.ambil-disini.web.id is actively serving HTTP responses with status code 200 and presents the page title “Expired Domain - IDCloudHost”. The host resolves to IP address 103.193.179.121, which is registered to PT Nara Cakra Studio in Indonesia. The infrastructure remains online, and the domain is currently flagged as high‑risk generic phishing in threat intel feeds. Defensive controls have already added the domain to the PhishDestroy blocklist, and it appears on one additional security blocklist. VirusTotal scans show that 22 of 95 security vendors classify the domain as malicious, reinforcing the high‑risk assessment. While the content of the site has not been publicly dissected, the combination of an expired‑domain landing page, active hosting, and multiple vendor detections suggests a purposeful use for credential‑harvesting or redirect campaigns. Uncertainty remains regarding the exact phishing payload, target audience, or any associated command‑and‑control infrastructure. Defenders should immediately block DNS resolution and HTTP traffic to 103.193.179.121 and frr.ambil-disini.web.id at perimeter devices, add the domain to internal blocklists, and monitor for any related patterns in user traffic. Continuous re‑scanning on VirusTotal and periodic verification of the blocklist status are advised to capture any changes in the domain’s activity.