4mb1l-had14h[.]vornsixid[.]com

The domain 4mb1l-had14h.vornsixid.com has been identified as a brand impersonation threat specifically targeting WhatsApp users. Despite its page title displaying 'DANA - Tarik Saldo', which suggests a potential connection to the Indonesian digital wallet DANA, the actual threat involves phishing for WhatsApp credentials. This domain is a classic example of a brand impersonation attack designed to deceive users into believing they are interacting with a legitimate service. No specific drainer kit was identified in the analysis, but the site's structure and behavior are consistent with credential harvesting.

Technical indicators for this domain are significant and warrant attention. VirusTotal data shows that 23 out of 95 security vendors flagged the domain as malicious, indicating a high level of consensus among security tools. The domain was registered through IONOS SE and created on February 08, 2026, which is notably in the future—a possible data error or deliberate obfuscation. It resolves to IP address 188.114.96.3 and appears on at least one security blocklist. Despite being flagged by many vendors, the domain was not listed on Google Safe Browsing at the time of analysis, which may leave some users unprotected.

As of the latest check, the domain is offline, likely due to takedown actions by hosting providers or security teams. However, the risk remains that similar domains may emerge or that the site could be reactivated. Users who may have visited the site should be cautious of any unsolicited messages or requests for personal information, especially those related to WhatsApp or DANA accounts. It is recommended to change passwords and enable two-factor authentication on affected accounts. PhishDestroy advises blocking this domain at the network level and educating users to verify URLs before entering credentials.