gerainokos[.]my[.]id

PhishDestroy identifies gerainokos.my.id as an active phishing domain currently under investigation for generic phishing activities. This domain leverages a deceptive naming structure to impersonate legitimate services, with no affiliation to any known brand or drainer kit identified at this stage. The infrastructure relies on a recently registered domain and a free SSL certificate, suggesting opportunistic threat actor tactics to evade initial detection mechanisms.

Technical indicators reveal this domain resolves to IP address 188.114.96.3 and was registered through PT JC Indonesia on February 17, 2026. VirusTotal currently reports 0 out of 95 detection engines flagging the domain, while the domain utilizes a Let's Encrypt SSL certificate. No blocklist entries were detected during initial analysis, indicating this is a newly active threat with minimal historical exposure.

Current status remains active, with PhishDestroy coordinating with stakeholders to assess potential brand impersonation vectors and update detection signatures. Immediate response includes blocking the domain at the network perimeter and advising users to avoid interaction. Remaining risk is under evaluation, though the domain's recent registration and low detection rate warrant heightened vigilance.