midassbhuy[.]diskon[.]com

The domain midassbhuy.diskon.com has been identified as a credential theft operation specifically targeting users of Indonesian e-commerce platforms. Analysis indicates this infrastructure was designed to harvest login credentials through fraudulent login portals mimicking legitimate retail services. The site is currently offline, though its historical activity warrants continued monitoring. Infrastructure analysis reveals the domain was registered through CV. Jogjacamp on April 13, 2000, though recent malicious activity suggests either a compromise or repurposing of legacy infrastructure. The domain resolves to IP address 103.30.147.120, hosted within AS46050 (PT JC Indonesia), and presents a Let's Encrypt SSL certificate (R13). Security vendors have flagged this domain with 16 detections out of 95 on VirusTotal, while appearing on one security blocklist. The page title 'Privacy error' suggests either an incomplete deployment or deliberate evasion of browser security warnings. Current assessment places this operation at elevated risk due to its regional targeting and credential harvesting capabilities. Organizations should implement DNS-level blocking for 103.30.147.120 and midassbhuy.diskon.com, while monitoring for similar patterns across the diskon.com namespace. Users who may have interacted with this domain should immediately reset credentials, particularly for Indonesian e-commerce accounts, and enable multi-factor authentication where available. Network defenders should examine logs for connections to 103.30.147.120 between April and May 2024, focusing on POST requests to login endpoints.