danaaindoonesia[.]wvx[.]my[.]id

This domain, danaaindoonesia.wvx.my.id, operates as a fraudulent replica of the legitimate DANA digital payment service. The site presents a counterfeit login interface designed to harvest user credentials, payment details, and personal information under the guise of authentic DANA transactions. Analysis of the page title, 'DANA - Apa pun transaksinya selalu ada DANA,' confirms the intent to deceive users into believing they are accessing the official DANA platform, thereby increasing the likelihood of successful credential theft or financial fraud. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain resolves to the IP address 172.67.150.38, which is associated with Cloudflare services, a common obfuscation tactic used to conceal malicious infrastructure. Detection metrics further substantiate the threat: the domain is flagged by 18 out of 95 security vendors on VirusTotal, and it appears on two independent security blocklists, including PhishDestroy and PhishingArmy. The registrar of the parent domain, wvx.my.id, has been previously linked to subdomain abuse for phishing campaigns, a pattern consistent with this incident. Additionally, the Gridinsoft trust score of 0/100 reflects a complete lack of legitimacy. Users who visited danaaindoonesia.wvx.my.id or entered credentials on the site should take immediate remedial action. First, revoke any sessions or logins associated with the fraudulent site and change passwords for all accounts where the same credentials may have been reused. Enable multi-factor authentication on critical accounts, particularly those linked to financial services. Monitor bank statements and transaction histories for unauthorized activity, and report any suspicious charges to the relevant financial institution. If personal or payment information was submitted, consider placing a fraud alert or credit freeze with local credit bureaus. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads to compromise user systems.