web-form-co[.]my[.]id

The domain web-form-co.my.id has been identified as a brand impersonation threat specifically targeting Google users. This domain is currently offline, but its recent activity involved hosting a fraudulent page designed to mimic Google's login interface, likely to steal credentials from unsuspecting visitors. The threat level is elevated, and users who may have encountered this site should take immediate precautions.

According to threat intelligence data, web-form-co.my.id was flagged by 12 out of 95 security vendors on VirusTotal, indicating widespread detection. The domain was registered through Cloudflare, Inc., and resolves to the IP address 172.67.173.219. It was found in 17 threat intelligence pulses on AlienVault OTX and appears on 2 security blocklists. Notably, the domain has no SSL certificate, which is a red flag for any site claiming to be a legitimate Google service. The page title was simply "Index of /", suggesting a directory listing or a bare-bones phishing kit.

As the domain is now offline, the immediate risk of credential harvesting is reduced. However, users are advised to avoid visiting the domain and to delete any emails or messages that link to it. PhishDestroy recommends that users who may have entered credentials on this site change their passwords immediately and enable two-factor authentication on their Google accounts. Always verify URLs before entering sensitive information, and use security tools to check domains for phishing indicators. For further verification, consult PhishDestroy's database for up-to-date threat reports.