aktifkaanpaylatters[.]jsoq[.]my[.]id

This domain, aktifkaanpaylatters.jsoq.my.id, is identified as a phishing site targeting users of DANA, an Indonesian digital payment platform. The page title, 'DANA - Apa pun transaksinya selalu ada DANA,' directly mimics the legitimate service, aiming to deceive users into entering sensitive credentials such as login details, payment information, or personal identification data. The site employs social engineering tactics to exploit trust in the DANA brand, likely distributing malware or harvesting credentials for financial fraud or identity theft. Analysis of the domain reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or appear legitimate. It resolves to the IPv6 address 2606:4700:3033::6815:4bba, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic used by threat actors to conceal origin infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 engines detecting it as phishing or fraudulent. Additionally, the domain appears on one security blocklist, and its SSL certificate is classified under the low-trust 'WE1' category, further indicating suspicious activity. Users who visited aktifkaanpaylatters.jsoq.my.id or entered credentials on the site should take immediate action to mitigate risk. First, revoke any entered credentials by resetting passwords for DANA and associated financial accounts. Enable multi-factor authentication where available to prevent unauthorized access. Scan local devices for malware using updated security tools, as phishing sites may deploy malicious payloads. Monitor financial statements for unauthorized transactions and report suspicious activity to the relevant financial institution. If personal data was exposed, consider placing a fraud alert on credit reports to prevent identity theft.