klaim-d4na[.]lingmung[.]my[.]id

This domain, klaim-d4na.lingmung.my.id, is assessed as an elevated-risk credential harvesting phishing site targeting financial service users. The page title, '𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔,' suggests an attempt to impersonate a legitimate customer support portal for a financial institution, likely aiming to harvest login credentials, personal identification details, or financial data from unsuspecting victims. Analysis indicates the domain was registered on March 10, 2026, through PT JC Indonesia, a registrar frequently associated with short-lived phishing infrastructure. The domain resolves to the IP address 188.114.96.3, which is hosted on AS13335, an autonomous system operated by a major content delivery network known for providing anonymity to malicious actors. As of the latest assessment, the domain is flagged by 24 out of 95 security vendors on a prominent threat intelligence platform, and it appears on at least one security blocklist. Notably, the domain lacks an SSL certificate, which is atypical for legitimate financial services and further undermines its credibility. The infrastructure was taken offline following detection, though historical resolution data confirms its prior operational status. To mitigate risks associated with this credential harvesting campaign, organizations and individuals should immediately block the domain and its resolving IP address (188.114.96.3) at the network perimeter. Security teams are advised to monitor for indicators of compromise, including unusual login attempts or unauthorized access to financial accounts, particularly those referencing the 'DANA' brand. End users should be educated on recognizing phishing attempts, such as verifying the legitimacy of customer support portals through official channels and scrutinizing domain names for irregularities. Additionally, implementing multi-factor authentication on financial accounts can significantly reduce the impact of credential theft.