dnaazxformnn[.]stormiexyz[.]my[.]id

This domain is flagged as an elevated-risk credential harvesting phishing site. Analysis indicates it is designed to deceive users into submitting sensitive login credentials through fraudulent web forms, a common tactic in targeted phishing campaigns. The infrastructure is currently offline, but prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered through PT JC Indonesia on March 03, 2026, an unusually future-dated registration that may indicate an attempt to evade detection. It resolves to IP address 172.67.179.5, hosted on AS13335 Cloudflare, Inc. in the United States. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often abused in phishing operations. Security vendors flagged the domain at a rate of 22/95 on VirusTotal, with one active blocklist entry and prior blocking by enterprise-grade security systems. The page title 'Index of /' suggests an exposed directory structure, a red flag for misconfigured or intentionally deceptive hosting. Mitigation steps for this threat include immediate blacklisting of the domain and IP across all network security controls. Organizations should monitor for any residual DNS queries or connections to 172.67.179.5, particularly from endpoints that may have been exposed to the phishing campaign. End-user education should emphasize the risks of credential submission on untrusted sites, especially those with exposed directory listings or unusual registration patterns. Security teams are advised to review logs for any prior interactions with this domain and conduct a sweep for compromised credentials if exposure is suspected. Given the future-dated registration, additional scrutiny of similarly structured domains is recommended.