web[.]id-lnf0[.]biz[.]id

The domain web.id-lnf0.biz.id is currently active and confirmed to host a credential theft phishing operation. Analysis indicates this infrastructure is designed to harvest user login credentials through deceptive landing pages, likely mimicking legitimate authentication portals. The domain remains operational and poses a high risk to users who may be redirected or lured into entering sensitive information. Infrastructure analysis reveals the domain resolves to the IP address 104.21.56.140 and is associated with a Google Trust Services SSL certificate, which may lend a false sense of legitimacy. The domain has been flagged by 4 of 95 security vendors on VirusTotal, appearing on two distinct security blocklists, including PhishDestroy and OpenPhish. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its malicious classification. The page title, 'Index of /', suggests an exposed directory structure, which is atypical for legitimate services and may indicate poor operational security or intentional exposure for malicious purposes. Current status confirms the domain remains active, with no takedown or mitigation observed. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. Endpoint protection should be updated to include this domain in phishing and malicious URL detection rules. Users who may have interacted with the domain should immediately reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Network logs should be reviewed for connections to 104.21.56.140 or requests to web.id-lnf0.biz.id to identify potential compromise.