layanan-danaid[.]konfirmasi[.]biz[.]id

PhishDestroy identifies layanan-danaid.konfirmasi.biz.id as an active crypto drainer domain posing as a financial service verification portal. The malicious infrastructure directs users to connect crypto wallets under the false pretense of transaction confirmation. Based on community telemetry, this domain abuses brand trust to siphon digital assets via deceptive wallet connection prompts. No direct impersonation of a specific brand is visible in the domain name, but the 'dana' substring (Indonesian for 'money') suggests a localized lure targeting Indonesian-speaking users.

Technical indicators confirm this domain as a high-risk endpoint. VirusTotal flags the domain with a 6/95 detection score across security vendors, while passive DNS resolution maps it to IP 188.114.96.3—an address associated with cloud-hosted malicious content. The domain is registered through a privacy-protected registrar, obscuring ownership details, and operates under a Let’s Encrypt SSL certificate to enhance authenticity. Public blocklist aggregators have cataloged this domain multiple times, reflecting its recognized malicious status. The domain’s recent creation timeline and rapid deployment of SSL further support its use in short-lived credential harvesting or asset theft campaigns.

The domain remains active and continues to serve malicious content. PhishDestroy’s automated systems have flagged it as an elevated threat with no active takedown observed at time of analysis. Immediate network blocking is strongly advised at the DNS and IP levels to prevent access. Despite its current status, residual risk persists due to potential domain or IP rotation. Users are urged to verify any unsolicited financial or wallet connection requests using PhishDestroy’s verification portal before proceeding.