ddna4[.]info

ddna4.info was registered on 2025-09-07 through NiceNIC International Group Co., Limited and uses Cloudflare name servers jason.ns.cloudflare.com and evelyn.ns.cloudflare.com. The domain resolves to the IPv4 address 54.37.207.59, which is assigned to AS16276 (OVH SAS) and geolocated in Germany. Infrastructure analysis shows the host is part of a shared hosting environment provided by OVH, a common platform for malicious actors. The domain carries a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of abuse, and has been listed by the PhishDestroy sinkhole as a malicious phishing site.

VirusTotal reports that five of ninety‑five scanning engines have flagged the domain, reinforcing the suspicion of malicious activity. No SSL/TLS certificate is presented for the site, meaning communications would occur over plain HTTP if the service were reachable. The domain appears on a single security blocklist, and no additional public blocklists, Safe Browsing entries, or OTX pulses have been observed.

As of the report date (2026-07-24) the domain is reported offline, limiting immediate threat exposure but preserving the associated infrastructure for potential future reuse. Defenders should continue to block the domain and its resolved IP address at network perimeter devices, monitor for any re‑activation or replication of the same host infrastructure, and consider adding the domain to internal blacklists. Ongoing vigilance is recommended, especially given the low trust score, prior detection by multiple vendors, and the involvement of a known phishing‑tracking service.