danaaiindonesiax[.]dwfg[.]my[.]id

This domain, danaaiindonesiax.dwfg.my.id, is identified as a high-risk phishing site specifically targeting users through brand impersonation of DANA, a prominent digital payment platform. Analysis confirms the site is designed to mimic legitimate DANA login portals, likely to harvest user credentials or financial information. The domain is currently offline, though prior activity indicates it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered on April 18, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or appear legitimate. It resolves to the IP address 172.67.192.78, geolocated to Cloudflare, Inc. in Canada, a common hosting provider for both legitimate and malicious sites. The domain is flagged by 19 of 95 security vendors on VirusTotal, and it appears on one security blocklist, with Google Safe Browsing explicitly labeling it as phishing. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is frequently leveraged by threat actors to lend a false sense of security to victims. The page title, 'DANA - Apa pun transaksinya selalu ada DANA,' directly mirrors the branding of the legitimate DANA platform, reinforcing the impersonation tactic. The current offline status of danaaiindonesiax.dwfg.my.id does not eliminate the risk, as domains of this nature are often reactivated or repurposed for future campaigns. Organizations and users are advised to block the domain and its associated IP address (172.67.192.78) at the network level to prevent accidental access. Security teams should monitor for any re-emergence of the domain or similar patterns, such as future-dated registrations or Cloudflare-hosted sites impersonating financial platforms. Users who may have interacted with the domain should immediately reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Proactive scanning for indicators of compromise, such as unusual login attempts or unauthorized transactions, is strongly recommended.