website-dana-id8[.]hpp2n[.]my[.]id

website-dana-id8.hpp2n.my.id was first observed on February 21, 2026, when the registrar record was created. The domain resolves to the Cloudflare‑owned address 188.114.96.3, which is announced as belonging to AS13335 in the United States. The SSL certificate in use is identified as “WE1”, a generic certificate commonly observed on compromised hosting.

VirusTotal scans returned fifteen detections out of ninety‑three vendors, showing that a minority of scanners flagged the host as malicious. The domain appears on a single security blocklist and has been taken down by the PhishDestroy takedown service, confirming that the infrastructure was actively used for phishing before being shut offline. Because the site is no longer reachable, active content analysis is not possible, and the exact phishing kit or credential‑harvesting method remains unknown.

Defenders should continue to block the domain at network perimeter devices, add the IP address 188.114.96.3 to deny lists, and monitor for any re‑hosting of the same page title or certificate fingerprint. Organizations that employ email filtering should keep the domain on blocklists, and threat‑intel teams should watch for new sub‑domains under the same registrar that may reuse the same hosting provider. Ongoing observation of Cloudflare‑assigned IP ranges for similar titles can help surface re‑emergent campaigns.