Who is breaking into blackname.biz?

Question

iPhone

From some point on, when entering the settings -> AppleID (and in some other cases), the daughter on the phone has a message about a bad certificate for the blackname.biz domain. I looked that now this domain leads to dan.com and apparently it is correct that the certificate does not fit. The problem is that I do not understand who and why accesses blackname.biz.
What I did and it did not help:
- Updated IOS to the current version
- Deleted all applications except the default
ones - Reset the cache and safari history
- Reset the phone and restored from the earliest available backup (not very old actually)

Answer 1

1) Nobody breaks. Most likely the root certificate somehow became this curve and left. "Settings" > "General" > "Profiles" and delete unnecessary there.
2) These are just browser notifications.

Answer 2

As an option. Enter the phone in dfu mode (recovery mode) and flash through atunes
Phone model? iOS version?

Answer 3

well actually there it is enough to reset certificates. In settings

No. Only native certificates are installed, which also arrived yesterday when updating IOS. No additional certificates installed, I checked. Please note , the problem is actually not related to certificates at all. If you try to open https://blackname.biz from your browser , you will also get an error, because there is really a different certificate. The question is - why is the phone trying to open this address.

Well, it's worth checking too much. Like antiviruses or some thread of Yandex browsers...

I deleted all applications except Apple ones. I wrote about it above.

Maybe the mail is breaking by the way? Receive/send mail...

I'll check, of course, but it's unlikely. Why does it always check email when I go to AppleID settings?