xznewdnaa-indocostmer[.]xoxoiuh[.]biz[.]id

This domain, xznewdnaa-indocostmer.xoxoiuh.biz.id, is identified as a credential harvesting phishing site designed to impersonate a financial customer service portal. Analysis of the page title, "𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔," indicates an attempt to deceive users into disclosing login credentials, financial details, or personal information under the guise of legitimate customer support. The domain employs typographical obfuscation and social engineering tactics to mimic trusted financial entities, increasing the likelihood of successful exploitation. Such campaigns are commonly used to facilitate unauthorized account access, identity theft, or financial fraud. Infrastructure analysis reveals that the domain resolves to the IP address 188.114.97.3, which is associated with a content delivery network provider in the United States (AS13335). The domain is currently flagged by 17 out of 95 security vendors on a prominent threat intelligence platform, indicating a consensus on its malicious nature. It appears on a single security blocklist, suggesting early-stage detection or limited distribution. The SSL certificate is issued by a widely trusted certificate authority, which may lend an air of legitimacy to the site despite its fraudulent intent. The registrar details for the domain are not explicitly provided, but the use of a subdomain under .biz.id may indicate an attempt to evade detection or leverage less restrictive registration policies. Users who have visited xznewdnaa-indocostmer.xoxoiuh.biz.id or interacted with its content are advised to take immediate remedial actions. Any credentials or sensitive information entered on the site should be considered compromised and must be changed across all platforms where the same credentials may have been reused. Affected individuals should monitor their financial accounts for unauthorized transactions and report any suspicious activity to the relevant financial institutions. Additionally, system scans using updated security tools are recommended to detect potential malware or secondary infections. Organizations should update their web filtering rules to block this domain and its associated IP address to prevent further exposure. Awareness of such phishing tactics, particularly those impersonating customer service portals, is critical for mitigating future risks.