danaa-indonesiaa4[.]resmi-wsl2[.]my[.]id

This domain, danaa-indonesiaa4.resmi-wsl2.my.id, was identified as a credential theft operation impersonating DANA, a widely used Indonesian digital payment platform. The site replicated DANA’s branding, including its official slogan, "Apa pun transaksinya selalu ada DANA," to deceive users into submitting login credentials or financial details. Analysis indicates the campaign targeted Indonesian-speaking users, likely through social engineering tactics such as fraudulent promotions or transaction alerts. The domain is currently offline, but its prior activity poses residual risks to users who may have interacted with it. Infrastructure analysis reveals the domain was flagged by 15 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It resolved to the IP address 188.114.97.3, which is associated with Cloudflare’s network, a common obfuscation tactic to mask hosting origins. The site employed multiple front-end technologies, including Bootstrap, Slick, jQuery, and CDN-hosted libraries (jsDelivr, cdnjs), to mimic legitimate web applications. Cloudflare Browser Insights and HTTP/3 were also detected, suggesting an attempt to enhance performance and evade basic detection mechanisms. The domain appeared on one security blocklist, and Gridinsoft assigned it a trust score of 0/100, reinforcing its malicious classification. The domain’s current offline status reduces immediate risk, but organizations and users should remain vigilant. Historical indicators, such as the IP address and associated technologies, should be incorporated into network defenses to block future iterations. Users who accessed the site are advised to reset credentials for DANA and any other accounts sharing the same login details. Financial institutions and digital payment providers should monitor for unauthorized transactions linked to this campaign. Proactive measures, including phishing awareness training and multi-factor authentication enforcement, are recommended to mitigate similar threats.