ddnatg[.]biz

Analysis of the domain ddnatg.biz indicates active phishing infrastructure targeting users with a fraudulent verification prompt. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). The page title, 'Небходимо пройти провеку' (translating to 'Verification Required'), suggests an attempt to deceive users into submitting credentials or personal information under the guise of a mandatory verification process. The site employs a 301 HTTP redirect, a common tactic to obscure the final destination or evade automated detection systems.

Infrastructure analysis reveals the use of Cloudflare nameservers (evelyn.ns.cloudflare.com and jason.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which may lend an appearance of legitimacy. However, the domain holds a Gridinsoft trust score of 0/100, and it is flagged by at least one security blocklist (PhishDestroy). As of the latest scan, two of 93 security vendors on VirusTotal have detected the domain as malicious, though the specific nature of the threat remains unconfirmed due to limited visibility into the final payload. The domain's hosting on Cloudflare, combined with its recent registration and low detection count, aligns with patterns observed in phishing campaigns designed to evade initial scrutiny.

Defenders should treat this domain as high-risk and consider blocking or monitoring traffic to 188.114.96.3, particularly in environments where Russian-language content or verification-themed lures are prevalent. Further investigation into associated infrastructure, such as redirect chains or linked domains, is recommended to assess the full scope of the campaign. The exact brand or service being impersonated is not yet confirmed, and no additional evidence of a specific phishing kit or targeted sector has been identified.