link-dana-sekarang[.]dana-terbaru[.]biz[.]id

This domain is flagged for elevated-risk credential theft targeting users of the DANA digital payment platform. Analysis indicates the infrastructure was designed to impersonate legitimate DANA services, likely harvesting login credentials or financial details under the pretext of a 'DANA Kaget' promotion. The specific threat type—credential theft—poses immediate risks to user accounts, including unauthorized transactions or identity fraud. Infrastructure analysis reveals the domain link-dana-sekarang.dana-terbaru.biz.id was hosted on IP 139.99.101.36 (Singapore, AS16276 OVH SAS) and secured with a Let's Encrypt SSL certificate (R13). VirusTotal reports 20 out of 95 security vendors detecting malicious activity, while the domain appears on at least one blocklist (PhishDestroy). The page title 'DANA Kaget buatmu' aligns with known social engineering tactics used to lure victims with fake rewards or promotions. Current status is offline, but historical resolution and certificate data suggest recent operational activity. Mitigation requires immediate action from security teams and end users. Organizations should block the domain and IP at perimeter defenses, while monitoring for related indicators such as the SSL certificate issuer (Let's Encrypt R13) or AS16276-hosted infrastructure. Users should be educated to verify DANA communications via official channels, avoiding unsolicited links or promotions. If credentials were entered, immediate password resets and multi-factor authentication enforcement are critical. Domain registrars and hosting providers should be notified for takedown coordination to prevent re-emergence.