cormentc2[.]web[.]id

The domain cormentc2.web.id has been flagged as a generic phishing threat, currently under investigation. This site impersonates a Cloudflare verification page, as indicated by the title "Just a moment...", a common tactic to steal login credentials. No specific drainer kit has been identified, but the page is designed to harvest sensitive information from unsuspecting visitors.

Technical analysis reveals that the domain was created on April 28, 2026, through the Indonesian registrar PT JC Indonesia, and resolves to IP address 188.114.97.3. It uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports 0 out of 95 security vendors have flagged the domain, meaning it has not yet been widely detected as malicious. However, it appears on one security blocklist and is currently listed in Google Safe Browsing as a threat, indicating it poses a risk to users.

The domain has been taken offline, which is a positive development, but the threat remains for any users who may have visited it before takedown. PhishDestroy recommends that anyone who interacted with this site change their passwords immediately and enable two-factor authentication on affected accounts. Users should also monitor for any suspicious activity related to their credentials. The low detection rate on VirusTotal underscores the importance of relying on multiple security layers rather than a single antivirus solution.