xlayaanid-paylternewz[.]tiaoxsid[.]my[.]id

This domain, xlayaanid-paylternewz.tiaoxsid.my.id, poses a direct phishing threat targeting users of DANÁ financial services. The site mimics legitimate DANÁ customer support pages, presenting a fraudulent interface designed to harvest login credentials, personal identification details, and financial information. Analysis of the page title, "𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔," confirms the intent to deceive users into believing they are interacting with an official DANÁ portal. The domain is actively serving malicious content, increasing the risk of credential theft and subsequent unauthorized access to victim accounts. Infrastructure analysis reveals multiple indicators of malicious activity. The domain is flagged by 22 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain resolves to IP address 172.67.203.18, hosted on Cloudflare's network (AS13335), a common tactic to obscure the true origin of the attack. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while legitimate, is frequently exploited by threat actors to lend an appearance of authenticity to phishing sites. The domain's registration details are obscured under the my.id ccTLD, limiting visibility into the registrar or creation date. Users who have visited xlayaanid-paylternewz.tiaoxsid.my.id or interacted with its content should take immediate action to mitigate potential compromise. First, revoke any credentials entered on the site and enable multi-factor authentication on all financial and sensitive accounts. Monitor accounts for unauthorized transactions or changes, and report any suspicious activity to the affected service provider. Clear browser cache and cookies to remove any residual session data. If personal or financial information was disclosed, consider placing a fraud alert or credit freeze with relevant bureaus. Network administrators should update blocklists to include this domain and its associated IP (172.67.203.18) to prevent further exposure within their environments. Given the domain's active status, continued vigilance is advised.