tnsfromnicindo[.]spencerztzy[.]web[.]id

The domain tnsfromnicindo.spencerztzy.web.id was registered on October 01, 2025 through the Indonesian registrar PT JC Indonesia and is currently listed as offline. The site’s sole visible artifact is the page title “𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔,” which suggests a targeted customer‑care front but provides no further context about the underlying content. DNS resolution points to the IP address 172.67.185.203, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain is served via Cloudflare’s nameservers (algin.ns.cloudflare.com and meg.ns.cloudflare.com) and does not present an SSL/TLS certificate, leaving the connection unencrypted.

VirusTotal has recorded 13 detections out of 93 security vendors, indicating that a minority of scanners have identified malicious characteristics. Independent security services have assigned a Gridinsoft trust score of 0 / 100, effectively flagging the domain as highly untrustworthy. The domain is presently blocked by the PhishDestroy mitigation service and appears on one additional security blocklist, confirming its inclusion in active threat feeds.

Because the site is offline, direct interaction is no longer possible, yet the infrastructure remains observable and may be reused for future campaigns. Defenders should continue to block the domain and the associated Cloudflare IP address at perimeter controls, monitor for any re‑registration of the domain or similar sub‑domains, and incorporate the domain’s identifiers—such as the registrar, nameservers, and page title—into threat‑intelligence enrichment pipelines. Ongoing vigilance is advised to detect any resurgence of activity that leverages the same hosting or naming patterns.