aktiifkaanpayllater[.]resmi-fxs3[.]art

This domain, aktiifkaanpayllater.resmi-fxs3.art, is flagged as a high-risk brand impersonation threat targeting DANA, an Indonesian digital payment platform. Analysis of the page title—"𝗗𝗔𝗡𝗔 | #𝗦𝗮𝘁𝘂 𝗗𝗼𝗺𝗽𝗲𝘁 𝗨𝗻𝘁𝘂𝗸 𝗦𝗲𝗺𝘂𝗮 𝗧𝗿𝗮𝗻𝘀𝗮𝗸𝘀𝗶"—indicates an attempt to deceive users into believing they are interacting with a legitimate DANA promotion or transaction page. No evidence of a crypto drainer or credential harvesting kit was identified in initial scans, but the domain’s structure and branding suggest a focus on financial fraud or credential theft under the guise of a promotional offer.

Technical indicators confirm the domain’s malicious nature. aktiifkaanpayllater.resmi-fxs3.art was registered on April 21, 2025, through Dynadot LLC and resolves to IP address 104.21.59.136, hosted on Cloudflare’s network (AS13335). VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious. The domain lacks an SSL certificate, increasing the risk of unencrypted data interception. It appears on one security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing (GSB) status was not explicitly provided but is likely flagged given the domain’s characteristics.

As of the latest assessment, the domain remains active and unresolved by the registrar. No takedown requests or sinkholing efforts have been observed. Users are advised to treat this domain as a confirmed threat and avoid interaction. Financial institutions and security teams should update blocklists to include this domain and its associated IP. Monitoring for similar domains using the "resmi-fxs3.art" subdomain pattern is recommended, as additional variants may emerge. The lack of SSL and recent registration further underscore the domain’s suspicious nature, warranting immediate defensive measures.