znlyanindonewdna[.]univercomz[.]biz[.]id

The domain znlyanindonewdna.univercomz.biz.id is a confirmed phishing site engaged in brand impersonation targeting DANA, a digital payment service. It presents itself as a legitimate DANA customer support page but is designed to deceive users into divulging sensitive information. No crypto drainer kit was detected, but the site poses an elevated risk due to its fraudulent representation of the DANA brand. As of the latest verification, znlyanindonewdna.univercomz.biz.id has been taken offline.

Technical indicators confirm the malicious nature of znlyanindonewdna.univercomz.biz.id. The domain was registered on September 24, 2025, through PT JC Indonesia and resolves to the IP address 104.21.18.188, hosted on Cloudflare's infrastructure (AS13335). It appears on 1 security blocklist (PhishDestroy) and is flagged by 15 of 95 VirusTotal vendors, including ADMINUSLabs, Criminal IP, and BitDefender. The site lacks an SSL certificate, and its nameservers are algin.ns.cloudflare.com and meg.ns.cloudflare.com. The observed page title, '𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔,' reinforces its impersonation of the DANA brand. Google Safe Browsing has not flagged the domain, but Gridinsoft assigns it a trust score of 0/100.

Users who interacted with znlyanindonewdna.univercomz.biz.id should immediately change their DANA account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or login attempts. Report the phishing domain to DANA's official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities for further action.