gular-motley-buffet10-20jtkonfirmasiii[.]pages[.]dev

Analysis of gular-motley-buffet10-20jtkonfirmasiii.pages.dev indicates this domain was actively impersonating DANA, a digital payment platform, as part of a fraudulent giveaway scheme. The domain was registered on February 24, 2026, through Cloudflare, Inc., and resolved to IP address 172.66.44.231, hosted on Cloudflare's infrastructure (AS13335) in the United States. The page title, '𝗗𝗔𝗡𝗔 - 𝗚𝗶𝘃𝗲𝗮𝘄𝗮𝘆 𝗨𝗮𝗻𝗴 𝗧𝘂𝗻𝗮𝗶,' explicitly references DANA and a cash giveaway, aligning with known brand impersonation tactics targeting financial services. The domain was served over HTTP/3 with HSTS enabled, utilizing a Google Trust Services SSL certificate (WE1), which is consistent with legitimate-looking but malicious infrastructure.

As of July 25, 2026, the domain has been taken offline, returning an HTTP 403 status. It appears on at least one security blocklist and is flagged by 16 of 93 security vendors on VirusTotal, confirming its malicious classification. Gridinsoft assigned a trust score of 0/100, further supporting its fraudulent nature. The domain's nameservers (garrett.ns.cloudflare.com and haley.ns.cloudflare.com) are associated with Cloudflare's DNS services, a common hosting choice for phishing campaigns due to its accessibility and perceived legitimacy.

While the domain is no longer accessible, defenders should treat any residual references to this infrastructure as high-risk. Historical DNS logs, proxy logs, or endpoint telemetry containing this domain should be reviewed for potential compromise. Organizations targeting DANA users or operating in regions where DANA is prevalent should prioritize blocking this domain at the DNS and proxy levels, even in its offline state, to prevent potential reuse or re-emergence. No evidence suggests this domain was part of a broader phishing kit or campaign beyond the observed brand impersonation.