dannax-paylteriidn[.]cheoxyo[.]biz[.]id

The domain dannax-paylteriidn.cheoxyo.biz.id is currently associated with a credential theft campaign. The threat is classified under generic phishing aimed at capturing user credentials. The investigation status is active, with ongoing monitoring to determine the full scope and impact of the campaign.

Technical analysis shows that dannax-paylteriidn.cheoxyo.biz.id uses an SSL certificate issued by Let's Encrypt, providing encryption but no assurance of legitimacy. The domain resolves to the IP address 104.21.41.80. According to VirusTotal, the domain has 0 detections out of 95 scanning engines, indicating it is not yet flagged by major antivirus or threat detection vendors. The domain's registrar information and creation date are currently under review, and no entries were found on common blocklists or trust scoring platforms at this time.

Given the domain's active status and its association with credential theft, users should exercise caution and avoid providing any personal or login information on sites hosted under this domain. It is recommended to implement network-level blocking, update endpoint protection systems, and educate users about the risks of credential phishing campaigns. Continuous monitoring and threat intelligence updates are advised to detect any changes in the domain's risk profile or if it becomes flagged by security vendors.