viral123link[.]com

PhishDestroy has flagged viral123link.com as an active generative phishing domain under investigation with a high-risk status. The domain mimics a popular gaming contest to harvest user credentials and personal data, specifically targeting Indonesian-speaking users based on the localized page content. This domain was flagged through PhishDestroy’s seed-based pipeline (seed ID f84026), showing zero detections on VirusTotal (1/95 engines) as of the latest scan. The domain resolves to IP 35.227.194.51 and uses a Let’s Encrypt SSL certificate for authenticity. Registered through NameSilo, LLC on April 14, 2026, the domain has not yet appeared on any public blocklists or threat intelligence feeds, indicating it may be newly active. The page title—“VIRAL123 : Lagi Viral! Game Seru dengan Peluang Kemenangan Besar”— reinforces the social engineering lure by promising high-value gaming rewards. Despite strong SSL adoption and low age, the absence of detection and the presence of a localized lure suggest a targeted, emerging campaign designed to bypass legacy defenses. To mitigate exposure to this generative phishing domain, organizations and users should immediately block viral123link.com at the DNS and firewall levels. Review outbound traffic logs for connections to 35.227.194.51 and inspect endpoint logs for access to the domain or related URLs. Conduct user awareness training emphasizing skepticism toward unsolicited gaming offers and the importance of verifying official contest pages. If any credentials or personal data were entered, immediately rotate passwords and enable multi-factor authentication on affected accounts. Consider reporting the domain to NameSilo’s abuse team and submitting samples to threat intelligence platforms to accelerate detection coverage. Continuous monitoring for similar domains using seed-based detection is recommended to preempt expansion of this campaign.