madanitv[.]net

This domain, madanitv.net, is identified as a brand_impersonation phishing site targeting Ankr, a decentralized blockchain infrastructure provider. Analysis indicates the domain was repurposed to mimic Ankr’s legitimate branding, likely to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts. No specific drainer kit signatures were detected, but the presence of a Let’s Encrypt SSL certificate (R13) and a misleading page title (MadaniTV | Televisi Islam Masyarakat Madani) suggests an attempt to obfuscate the true intent of the site. Infrastructure analysis reveals the domain was created on October 27, 2014, and registered through Tucows Domains Inc. It resolves to the IP address 103.118.177.183, located in Indonesia under AS137370 (PT. Infomedia Global Nusantara). The domain appears on two security blocklists and is flagged by 12 out of 95 security vendors on VirusTotal, including PhishDestroy and PhishingDB. No detections were reported on Google Safe Browsing at the time of analysis, though this may reflect delayed updates rather than a clean status. The domain is currently offline, reducing immediate risk to users. However, the historical infrastructure and registration details remain a concern, as threat actors may reactivate or repurpose the domain for future campaigns. Organizations should monitor for re-emergence of this domain or similar infrastructure, particularly those associated with the IP range 103.118.177.0/24. Network defenders are advised to block or sinkhole the domain and IP address in perimeter defenses, while users should verify the authenticity of any communication or web presence claiming affiliation with Ankr.