layaanfromzdanans[.]versaceinew[.]biz[.]id

The domain layaanfromzdanans.versaceinew.biz.id has been identified as a brand impersonation threat targeting DANA, a digital payment platform. This infrastructure was designed to mimic legitimate customer support pages under the guise of "DANA | Customer Care DANA." As of the latest verification, the domain is offline, though prior activity indicates malicious intent. Analysis of the domain reveals multiple technical indicators of compromise. The domain was registered through PT JC Indonesia and flagged by 19 of 95 security vendors on VirusTotal, reflecting elevated detection rates. It resolved to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States, despite the domain's Indonesian registration context. The domain was created on February 21, 2026, and appears on at least one security blocklist. Notably, the site lacked an SSL certificate, a deviation from standard security practices for financial services impersonation. Current status confirms the domain has been taken offline, likely due to enforcement actions. However, the infrastructure analysis reveals a pattern consistent with phishing operations targeting regional financial services. Organizations and users are advised to monitor for similar domains using the "versaceinew.biz.id" subdomain structure, particularly those impersonating DANA or other digital payment platforms. Network defenders should update blocklists to include the domain and associated IP address, while end-users should verify the authenticity of any communication claiming to be from DANA by cross-referencing official channels.