danaa[.]websitte[.]web[.]id

Analysis of the domain danaa.websitte.web.id, conducted on July 22, 2026, confirms its classification as an active generic phishing site. Infrastructure investigation reveals the domain resolves to the IP address 188.114.97.3, though no associated autonomous system number (ASN) or geolocation data is currently available. The domain's nameserver configuration is anomalous, with a status of NS_NOT_FOUND, which may indicate an attempt to obscure ownership or hosting details. Registrar information for the domain remains undisclosed in available intelligence, limiting attribution efforts. Detection metrics indicate moderate but growing awareness among security vendors. As of the report date, 13 of 95 security vendors on VirusTotal have flagged danaa.websitte.web.id as malicious, suggesting a consensus on its phishing classification.

Additionally, the domain appears on two independent security blocklists, further corroborating its threat status. Notably, the domain is actively blocked by PhishDestroy and OpenPhish, two specialized anti-phishing platforms, reinforcing its high-risk designation. The exact content or targeted brand of the phishing site has not been fully analyzed, as no page title, brand identifier, or phishing kit details are present in the available evidence. Consequently, the specific lure or victim profile remains uncertain. However, the domain's subdomain structure (websitte.web.id) and lack of legitimate association suggest it is likely part of a broader, opportunistic phishing campaign rather than a targeted impersonation of a specific organization.

Defenders are advised to treat danaa.websitte.web.id as an active threat. Network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended to prevent user exposure. Organizations should monitor for connections to this IP or domain in logs, particularly from endpoints with access to sensitive credentials or financial data.