trainingcenter[.]pkugombong[.]com

This domain, trainingcenter.pkugombong.com, functions as a credential harvesting site designed to impersonate legitimate Webmail Portal login interfaces. Analysis indicates the threat actor deployed a generic phishing framework to capture usernames, passwords, and potentially multi-factor authentication codes from unsuspecting users. The page title, 'Webmail Portal Login,' directly mimics corporate or institutional email login pages, increasing the likelihood of successful social engineering attacks against employees, students, or organizational users who mistake it for an authentic portal. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to the IP address 36.64.221.52 and is currently flagged by 19 out of 95 security vendors on VirusTotal, including detections from reputable threat intelligence sources. It appears on four distinct security blocklists, including those maintained by CERT-PL and OISD, and was registered through the registrar CV. Jogjacamp. The domain's status is now offline, though its prior operational state suggests a targeted campaign with potential residual exposure. Users who visited trainingcenter.pkugombong.com or entered credentials on the site should assume account compromise. Immediate actions include resetting passwords for all accounts accessed from the same device or network, enabling multi-factor authentication where available, and reviewing account activity for unauthorized logins or transactions. System administrators should block the domain and its associated IP (36.64.221.52) at the perimeter, and monitor network logs for connections to this infrastructure. Affected users should also scan their devices for malware, as phishing sites often serve as vectors for secondary payloads.