ambondjarum[.]id

This domain, ambondjarum.id, is actively engaged in credential harvesting phishing operations targeting users of financial and corporate login portals. Analysis indicates the site mimics legitimate authentication pages to capture usernames, passwords, and multi-factor authentication tokens, which are then exfiltrated to attacker-controlled infrastructure. The domain is designed to deceive users into entering sensitive credentials under the guise of account verification or security updates, a common tactic in business email compromise and fraud campaigns. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on February 21, 2026, through PT Jagat Informasi Solusi, an Indonesian registrar frequently associated with phishing domains. It resolves to IP address 104.21.85.229, part of AS13335 (Cloudflare, Inc.), a network often leveraged to conceal malicious infrastructure behind content delivery services. The domain appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, including detections for phishing, fraud, and malicious web content. The SSL certificate, issued by Google Trust Services (WE1), further masks the site’s true nature by presenting a seemingly legitimate encrypted connection. Users who have visited ambondjarum.id or entered credentials on the site should take immediate action to mitigate risk. All exposed passwords must be changed across any accounts where the same credentials were reused, with priority given to financial, email, and corporate systems. Enable multi-factor authentication using app-based or hardware tokens rather than SMS or email-based methods. Monitor accounts for unauthorized transactions, password reset attempts, or anomalous login activity. If corporate credentials were exposed, report the incident to internal security teams for containment and forensic analysis. Browser data, including saved passwords and session cookies, should be cleared to eliminate residual authentication tokens. Network administrators are advised to block the domain and its resolving IP (104.21.85.229) at the perimeter to prevent further exposure.