aktiifkan-payllaatersx[.]resmi-onz[.]my[.]id

On 25 July 2026, the domain aktiifkan-payllaatersx.resmi-onz.my.id was observed offline but previously hosted a page titled “DANA - Apa pun transaksinya selalu ada DANA”. The page title directly references the DANA brand, indicating a brand‑impersonation campaign aimed at deceiving users of the DANA digital‑wallet service. The domain was registered on 21 February 2026 through PT Registrasi Neva Angkasa and uses Cloudflare nameservers mario.ns.cloudflare.com and vita.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, an address belonging to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate was observed, meaning HTTPS connections would be unavailable or would trigger certificate errors.

Security intelligence shows the domain appears on one public blocklist, PhishDestroy, and has been flagged by 17 of 95 vendors on VirusTotal. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, reinforcing the malicious assessment. Because the site is currently offline, the full content, any credential‑harvesting forms, or redirect behavior cannot be verified. It is also unknown whether the domain ever resolved to a dedicated malicious hosting environment or relied solely on Cloudflare’s reverse‑proxy service. Defenders should continue to block the domain at network perimeter and update URL filtering policies to include the fully qualified domain name.

Threat‑hunters may query DNS logs for historical lookups to identify internal hosts that queried the domain and assess potential exposure. Incident responders should review any DANA‑related logins for anomalous activity and advise affected users to change passwords if credentials may have been submitted. Monitoring of the IP address 188.114.97.3 for future malicious use is advised, as Cloudflare IP ranges are frequently reused by unrelated actors.