danaid1[.]layanan-resmii[.]biz[.]id

PhishDestroy analysts have investigated the domain danaid1.layanan-resmii.biz.id, which was found to be a generic phishing site specifically impersonating the Indonesian digital wallet service DANA. The site, which displayed the title "DANA - Apa pun transaksinya selalu ada DANA," has since been taken offline, reducing immediate risk to users. This domain was created on March 7, 2026, and resolved to the IP address 188.114.96.3, which is associated with Cloudflare's infrastructure. The SSL certificate was issued by Let's Encrypt with fingerprint E8, a common choice for fraudulent sites due to its free and automated issuance process.

According to VirusTotal, 14 out of 95 security vendors flagged this domain as malicious, indicating a moderate consensus among security tools. The domain also appeared on one security blocklist, suggesting limited but recognized threat intelligence coverage. The IP 188.114.96.3 is part of Cloudflare's CDN network, which is frequently abused by phishers to obfuscate their true hosting location and evade takedowns. The use of a .biz.id domain further suggests targeting of Indonesian users, consistent with the DANA brand impersonation.

As the domain is now offline, the immediate phishing threat has been neutralized. However, similar domains may appear in the future. Users are advised to always verify the legitimacy of any website claiming to be DANA by checking the official URL (dana.id) and avoiding clicking on links from unsolicited messages. Organizations should monitor for lookalike domains and educate employees about phishing tactics. PhishDestroy recommends implementing email filtering, multi-factor authentication, and regular security awareness training to defend against such impersonation attacks.