starrdnfromindo[.]zeuce[.]biz[.]id

On July 23 2026 the domain starrdnfromindo.zeuce.biz.id was observed in an elevated‑risk brand‑impersonation campaign targeting the Indonesian digital‑wallet service DANA. The domain was registered on 26 December 2025 through the registrar PT JC Indonesia. Infrastructure analysis shows the name resolves to IP 104.21.60.51, which belongs to Cloudflare’s network (ASN 13335) and is geolocated in the United States. The domain is served by Cloudflare nameservers algin.ns.cloudflare.com and meg.ns.cloudflare.com, and no TLS certificate is presented, indicating the site was delivered over plain HTTP at the time of capture. The page title returned by the host is “𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔”, matching the brand‑targeted claim.

A Gridinsoft trust score of 0 / 100 further corroborates the malicious intent. The domain appears on a single security blocklist and is explicitly listed by PhishDestroy as a blocked resource. VirusTotal analysis shows 14 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. The site’s current status is offline, which limits real‑time verification, but the collected artifacts provide sufficient evidence for defensive actions.

Defenders should add the domain and its associated IP address to network‑level deny lists, block resolution of its authoritative nameservers, and monitor for any future re‑use of the same hosting infrastructure. Continuous observation of Cloudflare‑hosted assets related to the same IP range is recommended, as threat actors often recycle these services. Because the site lacks SSL, any attempted HTTP connections can be intercepted and logged for additional intelligence gathering. No further details about the page content are available, so investigations should focus on the infrastructure indicators and the observed brand‑impersonation pattern.