ak[.]core-service[.]my[.]id

This domain, ak.core-service.my.id, is identified as a credential phishing site specifically designed to impersonate Telstra, an Australian telecommunications provider. The page title, 'Sign in with your Telstra ID,' directly mimics the legitimate login portal, aiming to harvest user credentials through social engineering tactics. No evidence of a drainer kit or advanced malware payloads has been observed; however, the site employs basic deception techniques to trick victims into submitting sensitive information. The infrastructure and lack of SSL certificate suggest low-effort deployment, typical of opportunistic phishing campaigns. Analysis indicates the domain is flagged by 19 out of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence sources. It is registered through Cloudflare, Inc., a common registrar for both legitimate and malicious domains, and resolves to the IP address 142.250.181.243, hosted on AS15169 (Google LLC) infrastructure in the United States. The domain appears on two security blocklists, PhishDestroy and PhishingDB, further confirming its malicious classification. No SSL certificate is present, increasing the likelihood of detection by modern browsers and security tools. The creation date of the domain is not provided, but its recent takedown suggests a short operational lifespan. Currently, ak.core-service.my.id is offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future attacks, particularly if the threat actor re-deploys the phishing kit under a new domain or subdomain. Response actions should include monitoring for domain re-registration or similar naming patterns, as well as alerting users who may have interacted with the site prior to takedown. Organizations are advised to block the domain and associated IP at the network level, and to educate users on recognizing phishing attempts targeting telecommunications credentials. The elevated risk level is justified by the domain's confirmed malicious activity and its presence on multiple threat intelligence feeds.