sub-dana-id[.]cvgy[.]my[.]id

sub-dana-id.cvgy.my.id is a subdomain of cvgy.my.id. PhishDestroy first observed the hostname on Aug 22, 2026. The hostname explicitly references Dana; stored content metadata identifies the same apparent target. The captured page title is “DANA - Apa pun transaksinya selalu ada DANA”. Current evidence score: 89/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, OpenPhish, Cloudflare Radar, and URLScan. VirusTotal recorded 13 detections among 91 engines: alphaMountain.ai, CRDF, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Netcraft, OpenPhish, SOCRadar, Webroot on Aug 22, 2026 at 06:26 UTC. OpenPhish listed the hostname in the separate external-blocklist snapshot on Aug 22, 2026 at 10:20 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Dana and assigned phishing as its category on Aug 22, 2026 at 05:08 UTC. Non-positive and contextual checks: Google Safe Browsing returned no flag on Aug 22, 2026 at 13:09 UTC.

The collector marked the hostname reachable on Aug 22, 2026 at 03:13 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 172.67.168.13 (AS13335 Cloudflare, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Google Trust Services as the certificate issuer with validity through Oct 29, 2026; checked Aug 22, 2026 at 04:02 UTC.

The content indicators and 4 positive source findings support the current Dana impersonation and phishing classification. The target field identifies Dana, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.