danaid-layanan[.]cstomers[.]biz[.]id

Analysis of the domain danaid-layanan.cstomers.biz.id indicates it was actively impersonating the DANA brand, a known target for phishing campaigns. The domain was registered on February 21, 2026, through PT Registrasi Nama Domain and resolved to the IP address 172.67.132.170, which is associated with Cloudflare, Inc. (AS13335) in the United States. No SSL certificate was present, increasing the risk of unencrypted data transmission. The page title, 'DANA - Apa pun transaksinya selalu ada DANA,' explicitly references the DANA brand, aligning with the reported scam type of brand impersonation.

Infrastructure analysis reveals the domain used Cloudflare nameservers (noel.ns.cloudflare.com and paris.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. At the time of assessment, the domain was flagged by 18 of 95 security vendors on VirusTotal, a detection rate consistent with malicious activity. It also appeared on one security blocklist and was blocked by PhishDestroy. The domain has since been taken offline, though its prior resolution to a Cloudflare IP suggests potential for rapid redeployment under similar infrastructure.

Defenders should treat this domain as part of a broader phishing campaign targeting DANA users. The absence of SSL, combined with the use of Cloudflare nameservers and a recent registration date, are indicators of malicious intent. While the domain is currently offline, monitoring for re-registration or similar domains under the same registrar or hosting provider is recommended. No additional details about the phishing kit or specific attack vectors are available from the provided evidence.