reesmidanaaidn[.]blencou[.]biz[.]id

The domain reesmidanaaidn.blencou.biz.id has been identified as a brand impersonation threat targeting DANA, a digital payment service. Analysis confirms this domain was designed to mimic legitimate customer support pages, specifically displaying the page title '𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔' to deceive users into disclosing sensitive credentials or financial information. The current status of the domain is offline, though prior activity suggests it was actively used in phishing operations. Infrastructure analysis reveals the domain was registered through PT JC Indonesia on December 26, 2025, and resolves to the IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. The domain lacks an SSL certificate, a common red flag for fraudulent sites. It appears on one security blocklist and has been flagged by 17 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. The domain was also blocked by an internal threat intelligence feed, further corroborating its classification as a phishing threat. At present, reesmidanaaidn.blencou.biz.id is taken offline, though the underlying infrastructure remains a potential risk for future malicious activity. Organizations and users are advised to block the domain and its associated IP (188.114.96.3) at the network level. Security teams should monitor for any re-registration or re-emergence of the domain under similar naming conventions. Users who may have interacted with the site should reset credentials for DANA accounts and enable multi-factor authentication where available. Proactive monitoring of related domains registered through PT JC Indonesia is recommended to detect potential follow-up campaigns.