alyannx-nindob[.]spencerztzy[.]web[.]id

This domain, alyannx-nindob.spencerztzy.web.id, is identified as a credential theft operation impersonating DANA, a regional digital payment platform. The page title, "𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔," suggests an attempt to deceive users into submitting login credentials or personal financial details under the guise of customer support. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting campaigns targeting Southeast Asian markets. Analysis indicates the domain was registered on February 24, 2026, and resolved to IP address 172.67.185.203, hosted under AS13335 (Cloudflare, Inc.). Security vendors on VirusTotal flagged the domain at a rate of 20/95, while it appeared on one security blocklist and was blocked by PhishDestroy. The SSL certificate, issued under the WE1 root, provided no additional trust signals. Google Safe Browsing (GSB) status was not explicitly provided, but the domain's rapid takedown suggests detection by automated systems. The domain is currently offline, likely following enforcement action or infrastructure suspension. However, residual risk remains for users who may have interacted with the site during its active window. Organizations are advised to monitor for credential reuse attempts, particularly targeting DANA users, and to implement additional authentication layers for accounts potentially exposed. Network defenders should update blocklists to include the domain and associated IP, while users should verify payment platform communications through official channels only.