dana4-paylatersx[.]resmi-bkdd2[.]my[.]id

Analysis of dana4-paylatersx.resmi-bkdd2.my.id indicates a brand impersonation phishing domain targeting DANA, a digital payment service. The domain was flagged by 16 of 95 security vendors on VirusTotal, reflecting elevated detection consensus. Scamadviser and Gridinsoft both assigned a trust score of 1/100 and 0/100, respectively, further supporting its classification as malicious. The domain resolves to IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States, and was registered through Cloudflare, Inc. No SSL certificate was present at the time of assessment, increasing the likelihood of interception or manipulation of unencrypted traffic.

The page title, 'DANA - Apa pun transaksinya selalu ada DANA,' directly references the DANA brand, confirming the impersonation attempt. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Current status is offline, though defenders should treat this as a temporary state and assume the infrastructure may be reactivated. No evidence links to open-source threat feeds or additional context regarding the phishing kit or campaign timeline were provided.

Defenders should prioritize blocking the domain and its resolving IP at perimeter controls, including firewalls, DNS filters, and web proxies. Security teams are advised to review logs for connections to 188.114.97.3 or dana4-paylatersx.resmi-bkdd2.my.id within the past 30 days, focusing on endpoints exhibiting anomalous payment or authentication behavior. Given the use of Cloudflare hosting, additional domains may share the same infrastructure; cross-referencing AS13335 for recently registered or similarly named domains is recommended. No further details on payload delivery, credential harvesting mechanisms, or associated malware are available at this time.