angkatan[.]com

This domain, angkatan.com, is identified as a phishing site designed to harvest financial credentials through fake login portals. Analysis indicates no direct brand impersonation, but the infrastructure mimics common banking and payment gateway authentication flows. The site employs obfuscated JavaScript and static form fields to capture user input, which is then exfiltrated to a remote endpoint. No known crypto drainer or malware distribution components have been observed, but the credential theft mechanism aligns with broader phishing campaigns targeting Southeast Asian financial institutions.

Technical indicators confirm elevated risk: the domain is flagged by 14 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Registered through Web Commerce Communications Limited (WebNic.cc) on March 31, 2026, the domain resolves to IP address 103.133.133.73, hosted on an Nginx server. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. The domain appears on one security blocklist (PhishDestroy) and exhibits an anomalous creation date, suggesting domain squatting or pre-registration for malicious use. No Google Safe Browsing (GSB) flags are currently present, but this may reflect a lag in detection rather than absence of risk.

As of the latest assessment (seed c1db7a), angkatan.com remains active and unremediated. The hosting provider has not taken enforcement action, and the domain registrar has not suspended the registration despite clear indicators of abuse. Users are advised to block the domain at the network level and treat any login prompts from this site as fraudulent. Organizations should monitor for credential reuse attempts, as harvested data may be leveraged in follow-on attacks. Given the domain's persistence and lack of takedown, the risk level remains elevated, with potential for expansion into broader phishing or malware distribution campaigns.