danaaxindonesiiaa4[.]bqe[.]my[.]id

Analysis of the domain danaaxindonesiiaa4.bqe.my.id indicates that it was registered on 28 February 2026 through PT Registrasi Neva Angkasa. The domain resolves to the Cloudflare‑owned address 172.67.141.5, located in the United States under ASN 13335, and uses the Cloudflare nameservers mario.ns.cloudflare.com and vita.ns.cloudflare.com. No TLS certificate is presented, implying the site was served over plain HTTP at the time of observation. The page title returned by the server is “DANA – Apa pun transaksinya selalu ada DANA”, a direct reference to the Indonesian digital wallet brand DANA, which aligns with the generic phishing classification.

Threat intelligence shows the domain appears on a single security blocklist and has been flagged by PhishDestroy. VirusTotal scans report ten detections out of ninety‑three scanners, reinforcing the malicious assessment. Gridinsoft assigns a trust score of zero out of one hundred, indicating a high confidence of abuse. The current operational status is reported as offline, suggesting the site has been taken down or is otherwise inaccessible.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no content beyond the page title has been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any re‑hosting attempts that reuse the same sub‑domain pattern. Ongoing observation of the associated IP address and Cloudflare account may reveal further abuse campaigns. Organizations using the DANA brand should alert users to the possibility of fraudulent communications referencing the same tagline and advise verification through official channels.