formscosttmerdna[.]spencerztzy[.]web[.]id

This domain, formscosttmerdna.spencerztzy.web.id, is confirmed as a credential harvesting phishing site targeting users of financial services platforms. Analysis indicates an elevated risk level due to its specific focus on capturing login credentials through fraudulent customer support portals, as evidenced by the page title '𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔,' which mimics legitimate customer service pages of financial institutions. The domain's infrastructure and detection metrics further substantiate its malicious intent. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on March 03, 2026, through PT JC Indonesia, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.88.160, hosted on AS13335 Cloudflare, Inc., a network commonly leveraged to obfuscate malicious activity. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security to potential victims. Detection metrics show that 20 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. Additionally, the domain has been proactively blocked by enterprise-grade security systems, indicating prior recognition of its phishing capabilities. Mitigation against this credential harvesting threat requires a multi-layered approach. Organizations should immediately update their web filtering rules to block access to formscosttmerdna.spencerztzy.web.id and its resolving IP address, 104.21.88.160. End-users should be educated on recognizing phishing indicators, such as unusual domain structures, spoofed customer service portals, and unsolicited requests for login credentials. Financial institutions are advised to implement multi-factor authentication (MFA) and monitor for anomalous login attempts originating from this domain or its associated infrastructure. Security teams should also review logs for any prior interactions with this domain to identify potential compromised accounts and initiate password resets where necessary. Proactive monitoring of newly registered domains under the spencerztzy.web.id subdomain is recommended to detect further phishing attempts.