bulan77dewi[.]org

This domain is flagged as a fake login portal designed to harvest credentials from users under the guise of legitimate financial services. Analysis indicates the site mimics authentication interfaces for banking or investment platforms, tricking victims into entering sensitive login details. The infrastructure is structured to appear trustworthy, leveraging SSL encryption and a recently registered domain to evade initial scrutiny. Infrastructure analysis reveals the domain was registered on June 25, 2026, through NameSilo, LLC, a registrar frequently exploited for phishing operations. It resolves to the IP address 104.21.58.136, which currently shows no prior malicious associations in public blocklists. VirusTotal reports 0 detections out of 95 engines, suggesting the campaign remains undetected by most security vendors. The SSL certificate is issued by Google Trust Services, further masking its malicious intent behind a legitimate encryption provider. Users who have visited bulan77dewi.org or entered credentials on the site should immediately revoke any submitted login details and enable multi-factor authentication on all associated accounts. Monitor financial statements for unauthorized transactions and report the incident to relevant fraud prevention authorities. Network administrators are advised to block the domain and its resolving IP at the perimeter to prevent further exposure. Given the domain's recent creation and lack of prior detections, heightened vigilance is recommended for similar newly registered domains under the same registrar.