aktivasiixm-payllterdna[.]luciferxyz[.]biz[.]id

The domain aktivasiixm-payllterdna.luciferxyz.biz.id poses a significant threat, operating as a generic phishing site impersonating the DANA digital wallet brand. With an elevated risk level, this domain was designed to trick users into revealing sensitive login credentials under the guise of a customer care portal. The page title explicitly mimics DANA's branding, indicating a targeted attack against Indonesian users who frequently use this payment platform.

PhishDestroy's intelligence reveals alarming technical indicators. VirusTotal flags this domain with 22 out of 95 security vendors detecting malicious activity—a high confidence signal. The domain was registered on March 1, 2026, through PT JC Indonesia, a relatively obscure registrar. It resolves to IP address 103.187.146.157 and uses a Let's Encrypt SSL certificate (E8), which is common among phishing sites due to its free availability. The domain currently appears on one security blocklist and has been taken offline, but similar sites may reappear. No trust scores or reputation data are available, suggesting a newly created, untrusted entity.

Users must exercise extreme caution. Never enter DANA credentials or personal information on any site that is not the official DANA app or verified website. If you have already submitted data, change your DANA password immediately and enable two-factor authentication. Monitor your account for unauthorized transactions. Always verify URLs by checking the official DANA website or contacting customer support through known channels. PhishDestroy recommends reporting any suspicious domains to authorities and using anti-phishing browser extensions for added protection.