akttiydnap-idxx[.]mmexe[.]my[.]id

The domain akttiydnap-idxx.mmexe.my.id has been identified as a phishing infrastructure specifically designed to impersonate DANA, a widely used digital payment platform in Indonesia. Analysis confirms this as a generic_phishing threat, with the page title explicitly mimicking DANA's branding: 'DANA - Apa pun transaksinya selalu ada DANA.' The domain is currently offline, but prior activity indicates malicious intent to harvest credentials or financial information from unsuspecting users. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on March 31, 2026, an unusually forward-dated creation that may suggest attempts to evade detection or manipulate registration records. It resolves to the IP address 188.114.96.3, which has been flagged by 19 out of 95 security vendors on VirusTotal for association with phishing or fraudulent activities. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. No legitimate trust scores or reputable associations were found during assessment. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure remains a latent threat, as phishing domains often resurface under altered names or IP addresses. Users who may have interacted with this domain are advised to immediately reset credentials for DANA and any associated financial accounts. Organizations should update security controls to block the domain, its resolved IP, and monitor for similar patterns, such as newly registered domains with 'dana' or transaction-related keywords. Proactive monitoring of DNS records and SSL certificates for this infrastructure is recommended to prevent future exploitation.