danavista[.]cfd

Analysis of danavista.cfd shows a short‑lived domain that was registered on March 12, 2026 through Aceville Pte. Ltd. and immediately pointed at Cloudflare infrastructure (greg.ns.cloudflare.com, katelyn.ns.cloudflare.com). The domain resolves to IP 104.21.87.211, an address owned by AS13335 Cloudflare, Inc. in the United States, and serves content over HTTPS using a Let’s Encrypt certificate (identifier E8). The only visible artifact on the site is the page title “Registrasi - DANA VISTA,” indicating an attempt to mimic a registration portal for a service identified as DANA VISTA. The site is currently offline, but historical evidence places it on at least one public blocklist and it was actively blocked by the PhishDestroy feed.

Google Safe Browsing has classified the URL as a social‑engineering threat, and VirusTotal recorded five detections out of ninety‑four scanning engines, confirming that multiple security vendors consider the domain malicious. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing its low credibility. The combination of Cloudflare’s HTTP/3 support, a freshly issued SSL certificate, and rapid takedown suggests a typical phishing campaign that leveraged reputable hosting to gain trust before being revoked.

Uncertainty remains regarding the exact payload delivered, the phishing kit employed, and whether any credential harvesting succeeded before the takedown, as no page content beyond the title has been archived. Defenders should continue to block danavista.cfd at perimeter filters, update URL reputation feeds, and monitor for any re‑registration attempts using the same registrar or similar naming patterns. Incident responders encountering related traffic should validate TLS fingerprints against the known Let’s Encrypt certificate and correlate logs with the observed IP address to identify any residual malicious activity.