registrasipt1ki[.]inextart[.]biz[.]id

This domain is flagged as an active credential theft operation impersonating DANA, an Indonesian digital payment platform. The site presents a fraudulent customer support interface designed to harvest login credentials, payment details, or personal identification information from victims under the guise of legitimate service interactions. Analysis of the page title and visual elements confirms the impersonation of DANA's branding, including the use of the company's name and stylized text to enhance credibility and deceive users into entering sensitive data. Infrastructure analysis reveals multiple high-risk indicators. The domain registrasipt1ki.inextart.biz.id was created on May 25, 2026, with an unusually future registration date suggesting potential obfuscation or automated abuse. It currently resolves to the IP address 188.114.97.3 and is flagged by 21 out of 95 security vendors on VirusTotal, indicating broad detection as malicious. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate, issued by Let's Encrypt (serial number E7), provides HTTPS encryption but does not mitigate the underlying phishing threat. Users who have visited registrasipt1ki.inextart.biz.id or entered credentials on the site should take immediate action to mitigate risk. First, revoke any sessions associated with the fraudulent domain and reset passwords for DANA accounts and any other services where identical credentials may have been reused. Enable multi-factor authentication on all critical accounts to prevent unauthorized access. Monitor financial statements and transaction histories for signs of fraudulent activity. If personal or payment information was submitted, report the incident to the legitimate DANA security team and relevant financial institutions. Additionally, scan local devices for malware using updated security tools, as credential theft sites may deploy secondary payloads or redirect to exploit kits.