cetakkupon1901[.]my[.]id

This domain, cetakkupon1901.my.id, is confirmed as a phishing site targeting customers of Bank BRI, an Indonesian financial institution. Analysis indicates the page mimics legitimate Bank BRI promotional offers, specifically presenting a fraudulent "Kupon Undian Bank BRI" (Bank BRI Lottery Coupon) to deceive victims into submitting sensitive credentials, including login details and personal identification numbers. No evidence of a drainer kit was observed, but the site employs social engineering tactics typical of credential-harvesting campaigns. The domain does not appear to be part of a larger phishing-as-a-service infrastructure, suggesting a standalone operation. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 139.99.61.244, hosted on AS16276 (OVH SAS) in Singapore. The domain was registered on March 03, 2026, an unusually future-dated entry that may indicate registry manipulation or a placeholder. No SSL certificate is present, increasing the risk of interception during data transmission. VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, with a detection category of generic_phishing. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing. Registrar details are obscured, but the my.id country-code top-level domain suggests a regional targeting strategy. As of the latest assessment, cetakkupon1901.my.id has been taken offline, likely due to hosting provider intervention or registrar suspension. However, the elevated risk level persists due to the domain's recent creation date and the potential for re-emergence under a different infrastructure. Organizations should monitor for related domains using the same IP or registration patterns, particularly those leveraging Indonesian financial branding. End-users are advised to verify the authenticity of any Bank BRI communications through official channels and report suspicious domains to local cybersecurity authorities. The absence of SSL and the domain's presence on a single blocklist underscore the need for multi-layered detection mechanisms to mitigate similar threats.