commonwealth[.]biz[.]id

This domain, commonwealth.biz.id, is identified as an active credential-harvesting phishing site targeting users of financial services brands. Analysis indicates the infrastructure is designed to mimic legitimate banking portals, likely using cloned login interfaces to capture sensitive authentication credentials. No specific drainer kit signatures have been confirmed, though the domain exhibits behavior consistent with credential theft campaigns observed in similar financial phishing operations. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on June 23, 2026, through PT Jagoan Hosting Indonesia, a registrar frequently associated with phishing domains. It resolves to the IP address 107.175.148.253, hosted on AS36352 (HostPapa) in the United States. Detection engines report a VirusTotal score of 14/95, with Google Safe Browsing explicitly flagging the domain as phishing. The domain appears on one security blocklist, while its SSL certificate, issued by Let's Encrypt (serial number YE1), provides minimal assurance due to the automated and free nature of the certificate authority. As of the latest assessment, commonwealth.biz.id remains active and unresolved, posing a continued risk to unsuspecting users. No takedown actions have been observed, and the domain continues to resolve to its malicious IP address. Users are advised to block the domain at the network level and implement real-time phishing detection mechanisms. Organizations should monitor for credential reuse attempts stemming from this campaign, particularly those targeting financial sector employees or customers. The combination of recent registration, low detection rates, and active hosting infrastructure suggests this campaign may persist or evolve, necessitating ongoing vigilance.