ankiinternal[.]biz

The domain ankiinternal.biz is identified as a credential theft threat, designed to impersonate the Makecenter Order Management platform. This domain is currently offline, but its infrastructure and registration details indicate a deliberate attempt to harvest login credentials from users. The domain was created on February 21, 2026, and registered through Global Domain Group LLC, a registrar often associated with high-risk domains.

Infrastructure analysis reveals that ankiinternal.biz resolves to IP address 104.18.26.246, which is a Cloudflare IP. The site uses Node.js and Express technologies, along with HSTS, and has an SSL certificate issued by Google Trust Services. VirusTotal flags this domain with 3 out of 95 security vendors marking it as malicious, and it appears on 2 security blocklists, including PhishDestroy and OISD. The Gridinsoft trust score is 0 out of 100, indicating no trustworthiness. The page title Makecenter Order Management suggests the threat targets order management system users.

Current status is offline, which reduces immediate risk but does not eliminate the possibility of reactivation. Recommendations include monitoring for similar domain registrations under Global Domain Group LLC, blocking the domain at the network level, and educating users to verify URLs before entering credentials. Users who may have interacted with this domain should change passwords and enable multi-factor authentication on associated accounts.