alfaradan4[.]com

This domain, alfaradan4.com, is assessed as a credential-theft phishing site targeting users of a financial or payment service branded 'Alfara Danaa,' as indicated by the page title 'Daftar Akun | Alfara Danaa.' Infrastructure analysis reveals the domain was registered on March 12, 2026, through Dominet (HK) Limited and currently resolves to the IP address 45.87.42.74, hosted on AS62068 SpectraIP B.V. in the Netherlands. The site employs Nginx with OpenResty, a configuration commonly used for reverse proxy and load balancing in phishing campaigns. Cloudflare nameservers are in use, which may obscure origin infrastructure and complicate takedown efforts. As of July 24, 2026, the domain has been taken offline, though it previously returned an HTTP 200 status, suggesting active content delivery prior to disruption.

The SSL certificate is issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious sites due to its ease of acquisition. Two of 94 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, corroborating its classification as phishing infrastructure. The domain was blocked by PhishDestroy, a specialized anti-phishing service. While the exact content and functionality of the phishing page are not analyzed in this report, the combination of a financial-themed page title, recent registration, hosting on a bulletproof provider, and detection by security vendors supports the conclusion that alfaradan4.com was designed to harvest user credentials under the guise of an 'Alfara Danaa' service.

Defenders should treat this domain as compromised and include it in blocklists and monitoring systems. Given its current offline status, further forensic analysis may be limited, but historical DNS and SSL logs should be reviewed for additional indicators of compromise.