aku-sayang-ibuku[.]pages[.]dev

PhishDestroy identifies an active tech support scam hosted at aku-sayang-ibuku.pages.dev, a Cloudflare Pages domain registered through Cloudflare, Inc. This domain employs deceptive social engineering tactics, masquerading as a benign or affectionate webpage ('aku-sayang-ibuku' translates to 'I love you mom') to lure victims into fraudulent interactions. The campaign utilizes no known drainer kit but leverages a Let's Encrypt SSL certificate to enhance credibility. The threat actor’s infrastructure suggests an attempt to exploit trust in legitimate services while concealing malicious intent behind a culturally resonant facade.

This domain resolves to IP 172.66.46.242 and is registered via Cloudflare, Inc. As of this report, VirusTotal shows 0 detections out of 95 engines, indicating it remains undetected by most antivirus platforms. The domain is served over HTTPS with a Let's Encrypt certificate, increasing the likelihood of user trust. Google Safe Browsing (GSB) status is currently unlisted, and no public blocklist entries have been identified. The domain was created recently and is actively serving content, suggesting a live, evolving campaign. The absence of detections underscores the importance of proactive threat hunting rather than relying solely on automated detection systems.

This campaign is currently active, with no confirmed takedown or remediation actions in place. The risk level is classified as 'under_investigation' due to limited behavioral telemetry and low detection coverage. Users are advised to avoid interacting with this domain and report any suspicious encounters. Organizations should consider blocking the IP 172.66.46.242 and monitoring for related infrastructure. Remaining risk is moderate given the domain’s active status and lack of widespread detection, making it a potential vector for credential theft or malware delivery. Immediate user awareness and defensive blocking are recommended to mitigate exposure.