xmlyanan-foormxdna[.]blackopium[.]biz[.]id

PhishDestroy has identified xmlyanan-foormxdna.blackopium.biz.id as an elevated-risk domain engaged in brand impersonation, specifically targeting users of the Indonesian digital wallet service DANA. The domain was designed to deceive visitors by presenting a fraudulent customer care portal, complete with a page title reading "𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔." This kind of phishing attack typically aims to harvest login credentials, personal information, or payment details from unsuspecting users who believe they are interacting with an official DANA support channel.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis reveals that 18 out of 95 security vendors flagged this domain as malicious, a strong consensus among the cybersecurity community. The domain was registered through PT JC Indonesia on February 21, 2026, and resolves to IP address 104.21.28.33, which is associated with Cloudflare infrastructure. Its SSL certificate is issued by Google Trust Services / WE1, lending a false sense of legitimacy. The domain currently appears on one security blocklist and has been taken offline, but similar threats may reappear under different hostnames.

To stay safe, users should never enter sensitive information on any website that is not the official DANA domain. Always verify URLs carefully, especially for customer care pages. If you have already interacted with this phishing site, change your DANA password immediately and contact DANA support through their verified channels. Enable two-factor authentication on your account and monitor for any unauthorized transactions. PhishDestroy recommends reporting any suspicious domains to relevant authorities and keeping security software updated to detect future brand impersonation attempts.