ambonraya[.]id

This domain, ambonraya.id, is flagged as an active phishing site specializing in brand impersonation targeting eBay users. Analysis indicates the domain is designed to mimic legitimate eBay login or transaction pages, likely to harvest user credentials, payment details, or deploy secondary malware payloads. The page title, 'BOS5000: Lokasi Pertunjukan Permainan Elektronik Terkemuka Lindung Dan Meyakinkan Dua Puluh Dua Puluh Lima,' suggests an attempt to obfuscate its true purpose, possibly by presenting itself as an electronic gaming or entertainment platform while concealing phishing functionality beneath the surface. Infrastructure analysis reveals the following technical indicators: the domain is registered through PT Jagat Informasi Solusi and was created on February 21, 2026, indicating a recently established malicious asset. It resolves to IP address 172.67.211.225, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged by 17 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), providing a superficial layer of legitimacy while failing to mitigate the underlying threat. No Google Safe Browsing (GSB) detection is currently reported, though this may reflect a lag in propagation rather than an absence of risk. Current status confirms the domain remains active, with no takedown or sinkholing observed as of this report. The elevated risk level is justified by the combination of brand impersonation, low blocklist coverage, and Cloudflare-hosted infrastructure, which complicates mitigation efforts. Response actions should include immediate blacklisting in enterprise security gateways, DNS filtering, and endpoint protection rules. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on eBay accounts, and report suspicious links to their security teams. The remaining risk stems from the domain's ability to evade detection by a majority of security vendors, underscoring the need for layered defensive measures.