bantuan-danaa-id[.]layanan-offcial[.]biz[.]id

PhishDestroy identifies an active financial aid scam impersonating official Indonesian aid services hosted at bantuan-danaa-id.layanan-offcial.biz.id. The domain has been categorized under elevated threat status, with malicious content actively distributing fraudulent forms to harvest sensitive personal and financial data from unsuspecting users. This campaign specifically targets individuals seeking emergency financial assistance by mimicking legitimate government aid initiatives.

This domain was flagged by 8 of 95 VirusTotal security vendors, indicative of consistent malicious classification across multiple threat intelligence platforms. Registered under the free .biz.id subdomain service (layanan-offcial.biz.id), this site resolves to IP address 172.67.204.234 and utilizes a valid Let's Encrypt SSL certificate to appear legitimate. The domain was intentionally crafted to resemble official Indonesian government portal structures, embedding the misspelled word 'offcial' as a deceptive tactic to bypass scrutiny. As of this analysis, the domain remains active and unblocked by major browsers or security suites.

This financial aid phishing campaign poses elevated risk due to its plausible pretext and active distribution. Users are strongly advised to avoid this domain and verify any aid-related websites directly through official government channels. Security teams should block this domain at the network level and ensure sandbox inspection of any related IP traffic. PhishDestroy continues to monitor and report on this threat vector to prevent credential theft and financial fraud.