onlineratingwork[.]id

The domain onlineratingwork.id has been identified as a generic phishing threat designed to deceive online workers, freelancers, and remote job seekers. Analysis indicates the domain was actively used for credential harvesting and fraudulent job offers, though it is currently marked as offline. No specific brand impersonation has been confirmed, but the infrastructure aligns with known phishing campaigns targeting employment-related services. Infrastructure analysis reveals the domain was registered on June 08, 2026, through PT Web Commerce Communications, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been linked to other malicious activities in recent months. The domain appears on one security blocklist and is flagged by 21 of 95 security vendors on VirusTotal, with detections including phishing, fraud, and social engineering. The SSL certificate, issued by Let's Encrypt (serial number E8), provides minimal assurance, as phishing domains commonly abuse free certificate authorities to appear legitimate. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains a potential threat vector. Organizations and individuals are advised to block the domain and its associated IP (188.114.96.3) at the network level. Users who interacted with the domain should reset credentials for any accounts accessed during the exposure window and monitor for unauthorized activity. Security teams should review logs for connections to the domain or IP and correlate with other indicators of compromise.