xformdana-indonsia[.]thebestns[.]biz[.]id

This domain, xformdana-indonsia.thebestns.biz.id, is identified as a brand impersonation phishing site targeting DANA, an Indonesian digital wallet service. Analysis of the page title—'𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔'—and domain structure indicates an intent to deceive users into believing they are interacting with official DANA customer support or account verification portals. No cryptocurrency drainer kit signatures were detected, but the site aligns with credential theft tactics, likely harvesting login credentials, OTPs, or personal identification details under the guise of account recovery or security updates. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and currently resolves to the IP address 104.21.31.227, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal reports 17 out of 95 security vendors flagging this domain as malicious, while it appears on two security blocklists: PhishDestroy and PhishingDB. The domain lacks an SSL certificate, increasing the risk of unencrypted data transmission. No creation date was provided, but the absence of Google Safe Browsing (GSB) detection suggests either recent deployment or evasion techniques targeting automated detection systems. The domain has been taken offline, reducing immediate exposure risks. However, the underlying infrastructure—particularly the use of Cloudflare services—may facilitate rapid redeployment under new subdomains or domains. Users who interacted with this site should assume credential compromise and initiate password resets, enable multi-factor authentication, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the IP 104.21.31.227 and domain patterns associated with 'thebestns.biz.id' to mitigate future threats from this actor.