always-99[.]biz[.]id

always-99.biz.id is currently offline but was observed hosting a page titled “𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔”, explicitly referencing the DANA brand. The domain was registered on 14 April 2025 via Cloudflare, Inc., and uses Cloudflare’s authoritative nameservers carl.ns.cloudflare.com and nia.ns.cloudflare.com. DNS resolution points to 104.21.84.39, an IP owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is present, indicating the site was serving HTTP only before being taken down.

Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0/100, Scamadviser reports 1/100, and the domain appears on a single security blocklist. Google Safe Browsing flags the site for social engineering, and PhishDestroy has already blocked it. AlienVault’s Open Threat Exchange lists the domain in 18 separate threat‑intelligence pulses, while VirusTotal records 17 detections out of 95 scanned scanners; the detections include classifications such as phishing, malicious URL, and suspicious content, reinforcing the malicious intent. The combined evidence shows a high‑confidence brand‑impersonation campaign targeting DANA customers.

Uncertainty remains around the exact credential‑harvesting workflow and whether any endpoint was active before the takedown. Defenders should add the domain and its resolving IP to deny‑list rules, monitor for future look‑alike registrations, and enforce strict validation of DANA‑issued communications. The absence of an SSL certificate also prevents encrypted traffic analysis, allowing network sensors to capture any HTTP requests made to the site while it was active. Continuous threat‑intel feeds should be consulted for new indicators related to this infrastructure.