m[.]rencananabi[.]com

The domain m.rencananabi.com was registered on March 12, 2026 through GoDaddy.com, LLC and is currently active. The site presents a page titled "RencanaNabi" and is classified as a generic phishing operation. An HTTP 301 redirect is observed, and the site serves a valid Let’s Encrypt certificate (E8) over Cloudflare’s network, indicating the use of a trusted TLS provider while leveraging the cloud provider’s edge services.

Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and the DNS zone is hosted on Cloudflare nameservers joel.ns.cloudflare.com and raphaela.ns.cloudflare.com. The underlying web application employs Vue.js and delivers content via HTTP/3, suggesting a modern front‑end stack that may be used to mimic legitimate services and evade simple static detection.

Detection data reinforce the malicious nature of the site: VirusTotal records 14 out of 95 security vendors flagging the domain, and it appears on one external security blocklist. The site has been blocked by PhishDestroy, and its Gridinsoft trust score is 1 out of 100, reflecting an extremely low confidence rating. These indicators collectively confirm that the domain is being used to harvest credentials or other sensitive information, consistent with the generic phishing label.

Defenders should add m.rencananabi.com to network and endpoint blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce TLS inspection to capture any credential submissions. Email gateways should be configured to reject or quarantine messages containing URLs that resolve to the 188.114.97.3 address. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this infrastructure, and user awareness training should highlight the specific "RencanaNabi" branding to reduce the likelihood of successful phishing attempts.