aktiifkaanpaylaterrss4[.]resmi-yaa[.]my[.]id

This domain, aktiifkaanpaylaterrss4.resmi-yaa.my.id, is flagged for hosting a generic phishing campaign specifically targeting users of the DANA digital payment platform. The threat type is classified as payment phishing, designed to harvest credentials or financial details under the guise of a legitimate transaction interface. The risk level is elevated due to the domain’s recent registration, active distribution, and detection by multiple security mechanisms.

Infrastructure analysis reveals the domain was registered on February 26, 2026, through PT Registrasi Neva Angkasa, an Indonesian-based registrar. It resolves to the IP address 172.67.200.79, hosted on AS13335 Cloudflare, Inc., a common obfuscation tactic to mask origin infrastructure. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not mitigate the malicious intent of the domain. Detection metrics indicate 19 out of 95 security vendors on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on one security blocklist, and its page title, "DANA - Apa pun transaksinya selalu ada DANA," directly mimics the branding of the legitimate DANA service to deceive users.

Mitigation steps for this threat include immediate blacklisting of the domain and associated IP address (172.67.200.79) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate issuer details into security monitoring systems to detect and block related phishing attempts. End-users should be educated on recognizing payment phishing tactics, particularly those impersonating financial platforms, and encouraged to verify URLs and SSL certificates before entering sensitive information. Given the domain’s current offline status, continuous monitoring for re-emergence or similar domains registered through the same infrastructure is recommended.