frompayltersdnaid[.]blackopium[.]biz[.]id

Analysis of the domain frompayltersdnaid.blackopium.biz.id confirms its classification as a phishing site targeting customer support interactions, as indicated by its page title 'DANA | Customer Care DANA' and elevated risk assessment. The domain was registered on February 12, 2026, and currently resolves to the IP address 104.21.28.33, which is associated with Cloudflare, Inc. (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and Cloudflare Browser Insights, alongside common web technologies such as Bootstrap, jQuery, and jsDelivr, which are frequently leveraged in both legitimate and malicious sites. Detection data from VirusTotal indicates that 21 out of 94 security vendors have flagged this domain as malicious, reinforcing its classification as a phishing threat. The domain is also present on at least one security blocklist, as reported by PhishDestroy.

Trust scores from Scamadviser and Gridinsoft further support its malicious nature, with both services assigning a score of 1/100 and 0/100, respectively. The SSL certificate is identified as 'WE1,' though no further details on its issuer or validity are available in the current intelligence. The domain's nameservers are reported as 'NS_NOT_FOUND,' which may indicate an incomplete or misconfigured DNS setup, a common tactic in short-lived phishing campaigns. As of July 25, 2026, the domain has been taken offline, though its prior activity and infrastructure remain relevant for defensive measures.

The exact content and mechanics of the phishing attempt are not yet analysed, but the page title suggests an impersonation of a customer support portal, likely targeting users of a financial or payment service. Defenders should treat this domain as confirmed malicious and ensure it is blocked at the network and endpoint levels.