indonesiaax-dananews[.]fascist[.]biz[.]id

The domain indonesiaax-dananews.fascist.biz.id was reported on July 23, 2026 as an elevated‑risk generic phishing site that has been taken offline. Infrastructure analysis shows the domain resolves to the IP address 172.67.217.45, which belongs to Cloudflare, Inc. in Canada and is served behind Cloudflare’s edge network, as indicated by the presence of Cloudflare Browser Insights and HTTP/3 support. The TLS certificate is issued by Let’s Encrypt (certificate identifier E8), confirming the use of a free, automated certificate authority. Registration information lists PT JC Indonesia as the registrar, and the authoritative nameservers are INGRID.NS.CLOUDFLARE.COM and MARK.NS.CLOUDFLARE.COM.

The page title captured from the site contains a series of Unicode characters (𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔ð—), but no further content analysis is available. Detected front‑end libraries include Bootstrap, Slick, jsDelivr, jQuery, and cdnjs, which are commonly used in legitimate sites and do not provide direct evidence of malicious functionality. The threat is classified as a “Crypto Drainer” scam, aligning with the observed behavior of many campaigns that attempt to exfiltrate cryptocurrency assets. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist.

VirusTotal analysis shows that 21 of 91 scanned security vendors flagged the domain, indicating a moderate consensus of malicious intent. PhishDestroy has also blocked the domain. While the offline status prevents active probing, defenders should continue to monitor the associated IP and Cloudflare edge nodes for reuse, update URL filtering rules to include the domain and its known nameservers, and consider adding the IP address to network‑level blocklists.