danaaa-paaylaateerr[.]theiw[.]my[.]id

The domain danaaa-paaylaateerr.theiw.my.id is currently flagged as an active generic phishing site. Infrastructure analysis shows the domain resolves to IP address 104.21.1.108, which is part of the Cloudflare network, indicating the use of a reputable content‑delivery service to mask the true hosting location. No authoritative nameservers could be retrieved, as the DNS query returned NS_NOT_FOUND, which hampers attribution of the registrar and may be an intentional evasion technique.

The domain appears on two security blocklists and has been explicitly blocked by the phishing‑focused feeds PhishDestroy and OpenPhish, confirming its recognition by industry‑wide threat‑intelligence sources. VirusTotal scans report that 21 out of 91 security vendors have flagged the domain, providing a multi‑engine consensus that the site exhibits malicious characteristics. No additional data such as SSL certificate details, HTTP response codes, page title, or evidence links were available at the time of analysis, leaving the content of the landing page unverified.

Given the confirmed presence on blocklists, the active status, and the multi‑vendor detections, defenders should treat the domain as high‑risk. Recommended mitigations include adding the domain to outbound web‑filter deny lists, configuring DNS sinkholing for the associated IP range, and monitoring network logs for any connections to 104.21.1.108. Continuous re‑evaluation is advised, as further intelligence may emerge regarding the underlying phishing kit or targeted brand.