zlyanforrmxdanazm[.]stare[.]biz[.]id

Analysis indicates that the domain zlyanforrmxdanazm.stare.biz.id was registered on 21 February 2026 and subsequently used as a phishing vector targeting users of a service identified by the page title “𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔”. The site resolved to IP address 104.21.44.84, which is part of Cloudflare’s network (ASN 13335) located in the United States. The TLS certificate presented is identified as “WE1”, confirming that the site employed HTTPS. Reputation services have flagged the domain: one security blocklist lists it, PhishDestroy has actively blocked it, and Gridinsoft assigns a trust score of 0 out of 100.

VirusTotal scanned the domain and 10 of 93 security vendors returned a malicious verdict, reinforcing the malicious classification. The domain is currently offline, which limits further content inspection, and no additional evidence such as payload samples or redirects has been disclosed. Uncertainty remains around the exact phishing kit used and whether the domain was part of a larger campaign, as no information on the registrar, hosting specifics beyond Cloudflare, or associated URLs is available.

Defenders should add the domain and its resolving IP to blocklists, enforce DNS‑level filtering, and monitor for any resurgence of the same FQDN or similar substrings. Continuous re‑evaluation of Cloudflare‑originated IPs is advised, as threat actors often recycle infrastructure. Organizations that process “Dana” customer‑care credentials should alert users to disregard unsolicited communications that reference the domain, and incident response teams should treat any related credential submissions as compromised.