aktifkaann-danaa-paylateer[.]dzaun[.]web[.]id

This domain, aktifkaann-danaa-paylateer.dzaun.web.id, is flagged as a phishing resource impersonating the legitimate DANA digital payment platform. Analysis indicates the page title, 'DANA - Apa pun transaksinya selalu ada DANA,' directly mimics the official branding of DANA, a widely used Indonesian e-wallet service. The threat type is classified as brand impersonation, specifically targeting users through a fake login portal designed to harvest credentials. No evidence of a cryptocurrency drainer kit or direct financial transaction redirection was observed in the available telemetry, though credential theft remains the primary objective. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered through PT Cloud Hosting Indonesia and resolves to the IP address 104.21.40.239, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain was created on March 11, 2026, suggesting a recently deployed campaign. Detection metrics indicate elevated risk, with 23 out of 95 security vendors on VirusTotal flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend superficial legitimacy. The domain appears on one security blocklist, and no detections were recorded in Google Safe Browsing at the time of analysis. The domain is currently offline, likely following takedown actions or automated mitigation by the hosting provider. Despite its inactive status, residual risk persists due to the potential for credential reuse by threat actors. Users who interacted with the domain prior to its deactivation are advised to reset passwords for DANA and any associated accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and its resolving IP to prevent future access attempts. The use of Cloudflare infrastructure and a short-lived registration window aligns with common phishing tactics, emphasizing the need for continuous monitoring of similar domains.