danaa-indonesiaa4[.]resmi-mil[.]my[.]id

Analysis of danaa-indonesiaa4.resmi-mil.my.id indicates a credential phishing domain targeting users of DANA, an Indonesian digital payment service. The domain, created on April 19, 2026, is currently offline but was active long enough to be flagged by 17 of 94 security vendors on VirusTotal and appears on one security blocklist. The page title, rendered in stylized Unicode characters, explicitly references DANA and a verification or login process, suggesting an attempt to harvest user credentials. Infrastructure analysis reveals the domain resolved to 188.114.96.3, an IP address geolocated to Canada and associated with Cloudflare, Inc., a common hosting choice for phishing campaigns due to its privacy and CDN services.

The domain's trust scores are critically low, with Gridinsoft assigning a 0/100 rating and Scamadviser a 1/100, reinforcing its malicious classification. No nameservers were detected (NS_NOT_FOUND), which may indicate incomplete DNS configuration or deliberate obfuscation. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the domain's fraudulent intent. Technologies detected on the site include jQuery, OWL Carousel, and Cloudflare Browser Insights, which are legitimate but frequently exploited in phishing pages to enhance functionality and evade detection.

While the exact content and mechanics of the phishing kit remain unconfirmed due to the domain's offline status, the combination of the page title, scam type classification (credential phishing), and low trust scores provides sufficient evidence for defenders to treat this domain as malicious. Organizations should block the domain and its associated IP (188.114.96.3) at the network level, monitor for related subdomains or IPs under the same hosting provider, and alert users to the DANA-themed credential harvesting threat.