danaaa-paaylaateer[.]exga[.]my[.]id

The domain danaaa-paaylaateer.exga.my.id is actively being used to conduct a high-risk phishing campaign targeting users of the DANA payment platform. The site mimics the legitimate DANA interface, attempting to trick users into disclosing sensitive information such as login credentials and financial details. Analysis indicates that the threat poses a significant risk to user security and financial integrity.

Infrastructure analysis reveals that the domain resolves to the IP address 172.67.174.147. According to VirusTotal, 14 out of 95 security vendors have flagged this domain as malicious. The domain uses an SSL certificate issued by Google Trust Services, which may lend a false sense of security to unsuspecting visitors. The current status of the domain is active, indicating ongoing efforts to compromise users. The registrar and creation date of the domain are not specified in the provided intelligence, but the domain's presence on multiple blocklists suggests widespread recognition of its malicious nature.

If users have visited danaaa-paaylaateer.exga.my.id, they are advised to immediately change their DANA account passwords and enable two-factor authentication. Users should also monitor their financial accounts for any unauthorized transactions and report any suspicious activity to their financial institution. It is recommended that users refrain from clicking on any links or entering personal information on this or any similarly suspicious sites. Security experts suggest using reputable security software to scan for and remove any potential malware that may have been downloaded during the visit.