dnmz-formmy[.]factorynew[.]biz[.]id

On 23 July 2026, investigators examined the domain dnmz-formmy.factorynew.biz.id, which is currently taken offline. The site was registered on 6 December 2025 through PT JC Indonesia and uses the authoritative name servers suspend1.liqu.id and suspend2.liqu.id. DNS resolution points to the IP address 172.67.212.124, an address owned by Cloudflare, Inc. (AS13335) located in the United States. No TLS certificate was observed, indicating the site operated without HTTPS protection. Content analysis revealed a page title of “𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔”, explicitly referencing the Indonesian digital wallet brand DANA.

The branding aligns with the classified scam type of brand impersonation, suggesting the domain was used to lure victims by masquerading as an official DANA customer‑care portal. VirusTotal scans reported 16 detections out of 95 security vendors, confirming malicious intent. The domain is listed on a single external blocklist and was actively blocked by the PhishDestroy filtering service. Independent reputation services assigned extremely low scores, with Gridinsoft reporting 0 / 100 and Scamadviser 1 / 100, reinforcing the conclusion that the infrastructure is untrusted.

The observable evidence confirms that the domain was deliberately crafted to impersonate DANA and hosted on a shared Cloudflare front‑end, a common technique for rapid deployment and evasion. Because the site is offline, direct payload collection is not possible, and the exact phishing kit or credential‑harvesting mechanism remains unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any future reuse, and add the observed page title and registration attributes to detection signatures. Ongoing threat‑intel feeds should be queried for any resurgence of the same name‑server pair or similar Cloudflare‑hosted domains targeting DANA users.