amgindonesia[.]org

This domain, amgindonesia.org, is actively engaged in a cryptocurrency airdrop scam, specifically targeting users with a fraudulent offer titled 'BTC Airdrop — $100 Reward for Active Traders.' The threat type is classified as brand impersonation, leveraging deceptive tactics to mimic legitimate cryptocurrency reward programs. Analysis indicates the domain is designed to harvest sensitive information or deploy crypto-draining malware, a common vector in recent phishing campaigns targeting digital asset holders. No specific drainer kit has been conclusively identified at this stage, but the page structure and messaging align with known crypto-theft operations observed in prior incidents tagged with seed fe4fc4. Infrastructure analysis reveals the following technical indicators: the domain was registered on November 14, 2024, through CV. Rumahweb Indonesia, a registrar frequently associated with newly created phishing domains. It resolves to the IP address 103.247.10.176, which has been linked to other suspicious activities in recent months. VirusTotal detection metrics show 5 out of 95 security vendors flagging the domain as malicious, a relatively low but non-negligible detection rate that may indicate evasion techniques or recent deployment. The domain currently holds a valid SSL certificate issued by Let's Encrypt, a tactic often employed to lend an appearance of legitimacy. As of the latest assessment, Google Safe Browsing (GSB) has not yet listed the domain, and no additional blocklist entries have been recorded in public threat intelligence feeds. The domain remains active, with no evidence of takedown or mitigation efforts at the time of this report. The risk level is classified as high due to the direct financial threat posed by crypto-draining schemes and the domain's operational status. Users are advised to block access to the domain at the network level and refrain from interacting with any content hosted on it. Organizations should update endpoint protection rules to include the domain and its resolving IP in denylists. Given the domain's recent registration and low detection rate, continuous monitoring is recommended to track potential shifts in infrastructure or additional malicious payloads. The lack of widespread blocklisting underscores the need for proactive threat hunting in environments where cryptocurrency transactions are common.