blockchain[.]ilkom[.]unsri[.]ac[.]id

The domain blockchain.ilkom.unsri.ac.id was registered on 21 February 2026 through the Unsri.ac.id registrar and currently resolves to the IPv4 address 103.208.137.166, which is allocated to AS132676 (Universitas Sriwijaya) in Indonesia. DNS resolution uses four authoritative name servers (BB1.UNSRI.AC.ID, NS1.UNSRI.AC.ID, NS2.UNSRI.AC.ID, NS4.UNSRI.AC.ID). HTTP requests receive a 307 temporary redirect response and the site presents a TLS certificate issued by Let’s Encrypt (certificate type E7). Automated analysis identifies a stack consisting of Node.js, Ubuntu, React, Next.js, Apache HTTP Server and Webpack, indicating a modern web application framework. The page title returned by the server is "Inventus Chain", which suggests the site is attempting to masquerade as a service or product named Inventus Chain, although the exact nature of the impersonated entity has not been verified. The domain appears on a single security blocklist and has been flagged by PhishDestroy; its Gridinsoft trust score is 0/100, reflecting a high likelihood of malicious intent. No detections are reported from VirusTotal scans, but the absence of detections does not constitute evidence of safety. The infrastructure is still active as of 12 July 2026 and the risk level is listed as under investigation. Defenders should consider adding the domain and its resolving IP to network‑level deny lists, monitoring DNS queries for the listed name servers, and employing URL filtering to block access to the site. Continuous observation is recommended to capture any subsequent payloads or credential‑harvesting pages that may be deployed on the infrastructure.