invikita[.]id

PhishDestroy has opened an active investigation into invikita.id after detecting a live credential-harvesting campaign targeting Indonesian users. The domain was created on 28 February 2026—only days before this report—indicating a fast-moving threat actor registering fresh infrastructure to evade blocklists. The site currently resolves to IP address 202.10.43.48 and is protected by a Let’s Encrypt SSL certificate, giving the false impression of legitimacy while quietly collecting credentials entered into spoofed login forms. This domain poses a SPECIFIC threat: a low-volume, high-impact credential phishing page designed to harvest usernames, passwords, and possibly two-factor codes. VirusTotal shows zero detections out of 95 engines at the time of analysis, confirming the site remains under the radar. The registrar is PT Digital Registra Indonesia, a legitimate provider that has not yet suspended the domain. With only a single day of public exposure, invikita.id has not yet appeared on major blocklists, leaving organizations and individuals without automated protection against this fresh threat. If you or anyone in your network visited invikita.id, assume credentials entered were compromised. Immediately change the password on that account and any other accounts that reused the same password. Enable multi-factor authentication where available, scan local devices for malware, and report the domain to your security team or email provider for blocking. Treat any unsolicited messages referencing invikita.id as suspicious, even if they appear to come from known contacts.