formindoxdnanms[.]bascanetz[.]my[.]id

This domain, formindoxdnanms.bascanetz.my.id, was observed hosting a generic phishing campaign aimed at credential harvesting. The site currently returns no SSL certificate, indicating that any data submitted would be transmitted over plain HTTP. DNS resolution points to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and located in the United States. Registration details show the domain was provisioned through Cloudflare, a common front‑end service used by malicious operators to hide infrastructure.

Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 out of 100, while Scamadviser gives a 1 out of 100 rating. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy filtering service. VirusTotal analysis reports that 14 of 95 antivirus and URL scanners flagged the domain as malicious, reinforcing the suspicion of phishing activity. The site has been taken offline at the time of reporting, which limits immediate observation of page content, HTTP response codes, or page titles.

Consequently, the exact landing page structure and any targeted brand remain unknown. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any future re‑hosting on the same IP or Cloudflare account, and incorporate the IP address 188.114.96.3 into threat‑intel feeds. Given the low trust scores, blocklist presence, and multi‑vendor detections, the infrastructure should be considered high risk until confirmed remediation.