d4nz1k[.]nftlm[.]biz[.]id

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting DANA, a digital payment platform. Analysis indicates the domain was designed to deceive users into believing it is an official DANA service, as evidenced by the page title 'DANA - Apa pun transaksinya selalu ada DANA,' which mirrors legitimate branding. The threat type is classified as brand impersonation phishing, where attackers exploit trust in a recognized brand to harvest credentials, financial data, or distribute malware. Infrastructure analysis reveals the domain d4nz1k.nftlm.biz.id was registered on February 21, 2026, and currently resolves to the IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. The domain appears on one security blocklist and is flagged by 21 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. Notably, the domain lacks an SSL certificate, a critical security gap that exposes user data to interception during transmission. The domain has since been taken offline, but its prior activity and infrastructure remain indicators of compromise. Mitigation steps for organizations and users include blocking the domain and its resolving IP (188.114.96.3) at the network perimeter to prevent access. Security teams should monitor for related domains registered under the same pattern (e.g., random subdomains under nftlm.biz.id) or similar creation dates. Users who may have interacted with the domain should reset credentials for DANA and any associated financial accounts, enable multi-factor authentication, and review transaction histories for unauthorized activity. Enterprises should also educate users on identifying brand impersonation tactics, such as scrutinizing domain names, checking for SSL certificates, and verifying official communication channels.