ddna4[.]pro

Analysis of ddna4.pro indicates an active phishing infrastructure targeting Russian‑language users, as evidenced by the page title "Небходимо пройти провеку". The domain was registered on September 07, 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335) with the public address 104.21.77.223 located in the United States. The site serves content over HTTPS using a Google Trust Services / WE1 certificate and returns HTTP 200 responses, while HSTS is enforced, suggesting an attempt to appear legitimate. Technical fingerprints reveal a Node.js runtime with the Express framework, consistent with many low‑cost phishing kits.

Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist, further corroborated by its inclusion in an AlienVault OTX pulse. VirusTotal reports that five of ninety‑five scanners flagged the domain, and PhishDestroy has already blocked it. The domain resolves to two Cloudflare nameservers (jason.ns.cloudflare.com and evelyn.ns.cloudflare.com).

While the exact payload and credential‑harvesting mechanisms have not been publicly disclosed, the combination of a Russian‑language prompt, low trust metrics, and presence on threat‑intel feeds confirms a high‑risk phishing operation. Defenders should immediately add ddna4.pro to URL filtering policies, monitor outbound connections to its IP address, and consider full network isolation of any internal hosts that have accessed the site. Continuous re‑scanning is advised to detect any evolution of the payload or additional malicious indicators.