danaaterrpendiing[.]resmi-wsl3[.]my[.]id

This report analyzes the domain danaaterrpendiing.resmi-wsl3.my.id, which is a phishing site impersonating the DANA digital payment platform. Based on the page title "DANA - Apa pun transaksinya selalu ada DANA," the site fraudulently claims to represent the legitimate DANA service. The threat posed is banking phishing, designed to steal user credentials and financial information from victims attempting to access their accounts.

Technical analysis reveals the site was flagged by 18 out of 95 VirusTotal vendors. It is blocklisted by one source, with specific detection by ADMINUSLabs, Criminal IP, Cluster25, CRDF, and CyRadar. The domain was created on 2026-03-12, hosted on IP 172.67.222.108 in the United States, under AS13335 (Cloudflare, Inc.). The SSL certificate is WE1, and the site utilizes Bootstrap, Slick, jQuery, jsDelivr, and cdnjs technologies. The DOM risk score is 73.

Currently, the site is DOWN or OFFLINE. Risk assessment from GridinSoft is 0 out of 100, and from ScamAdviser is 1 out of 100, indicating a very low trust level and high risk. Despite being offline, the domain remains a significant threat for credential harvesting if reactivated.