jagoangka[.]totovip[.]it[.]com

The domain jagoangka.totovip.it.com was registered on 24 March 2026 through Intis Telecom Limited. Its authoritative name servers are ns1.it.com, ns2.it.com and ns3.it.com. The site did not present an SSL certificate at the time of observation, indicating that traffic was served over plain HTTP. DNS resolution pointed to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. and is geolocated to Canada. The hosting provider is therefore Cloudflare, which often masks the true backend infrastructure. The page title returned by the web server matched the fully qualified domain name, and the page was built with Bootstrap, Vue.js, AMP, LiveChat, jQuery (including CDN delivery), Facebook Pixel, and Cloudflare Browser Insights.

No additional content was captured because the service was taken offline before a full page scrape could be performed. Security telemetry shows the domain appears on a single blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scanned the hostname and four of ninety‑four AV engines flagged it as malicious, contributing to an elevated risk rating. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the suspicion. The domain is currently listed as offline, which may be a temporary takedown by the hosting provider or a self‑imposed shutdown by the operators. Uncertainties remain regarding the specific phishing campaign payload, target audience, and whether any credential‑stealing form was ever hosted.

No TLS certificate, no evidence of a landing page, and the brief lifespan limit the ability to attribute the infrastructure to a broader campaign. Defenders should add 188.114.97.3 to network‑level block lists, monitor for DNS queries to the listed nameservers, and ensure that any outbound connections to the domain are denied. Continuous re‑query of public blocklists such as PhishDestroy is advised, as the domain may be re‑activated.