workservermoyasset[.]cyou

Analysis of the domain workservermoyasset.cyou indicates it was actively involved in a credential-theft phishing campaign prior to being taken offline. The domain was registered on February 23, 2026, through Global Domain Group LLC, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolved to IP address 109.110.188.204, hosted on AS199695 (PT Anym Network Indonesia), an autonomous system previously linked to phishing and malware distribution. Nameservers for the domain were dns1.anymhost.id, dns2.anymhost.id, dns3.anymhost.id, and dns4.anymhost.id, further tying the infrastructure to the same provider.

At the time of assessment, the domain returned an HTTP status consistent with an open directory listing, as indicated by the page title 'Index of /'. No SSL certificate was present, increasing the likelihood of interception or manipulation of transmitted data. Detection engines on VirusTotal flagged the domain as malicious, with 20 of 93 security vendors marking it as phishing-related. The domain appears on at least one security blocklist and was included in a threat intelligence pulse on AlienVault OTX, suggesting broader awareness within the security community.

PhishDestroy also blocked access to the domain, reinforcing its classification as a phishing threat. While the exact content of the phishing page remains unconfirmed due to the domain's offline status, the combination of open directory listings, absence of encryption, and detection by multiple security vendors supports the conclusion that workservermoyasset.cyou was used for credential harvesting. Defenders are advised to treat the domain as compromised and monitor for related infrastructure, particularly within AS199695 and associated nameserver ranges. Network-level blocking of 109.110.188.204 and related subnets may mitigate residual risk from this campaign.