aktiffkan-paylaterz[.]file-resmii4[.]my[.]id

This domain, aktiffkan-paylaterz.file-resmii4.my.id, is actively engaged in credential theft targeting users of the DANA digital payment platform. Analysis of the page title, "DANA - Apa pun transaksinya selalu ada DANA," confirms brand impersonation, a tactic commonly used to deceive victims into entering login credentials or financial details on fraudulent pages. No direct evidence of a crypto drainer kit was observed, but the domain’s infrastructure and behavioral patterns align with credential harvesting operations. Technical indicators reveal the domain is flagged by 19 out of 95 security vendors on VirusTotal, a notable detection rate for phishing infrastructure. It resolves to the IP address 104.21.34.213, hosted on Cloudflare’s network (AS13335) in the United States, which is frequently leveraged to obscure the true origin of malicious domains. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy while failing to mitigate the underlying threat. The domain appears on one security blocklist, and its registrar details remain obscured due to the use of a subdomain under my.id. No Google Safe Browsing (GSB) listing was identified at the time of analysis, though this does not preclude malicious intent. As of the latest assessment, the domain remains active and continues to pose a high risk to users. The use of Cloudflare’s infrastructure complicates takedown efforts, as it masks the true hosting provider and delays mitigation. Organizations and individuals are advised to block the domain and its resolving IP at the network level, while users should be alerted to the impersonation of DANA’s branding. Monitoring for similar subdomains under file-resmii4.my.id is recommended, as additional malicious variants may emerge. Credential theft campaigns of this nature often escalate, and proactive measures are critical to preventing further compromise.