aktifkaanpaylatersxll[.]resmi-kaz2[.]my[.]id

This domain aktifkaanpaylatersxll.resmi-kaz2.my.id is classified as a brand_impersonation threat targeting the DANA digital wallet service. The infrastructure is assessed as a credential theft landing page designed to deceive users into submitting authentication data under a fraudulent transactional interface. The page is currently taken offline, but historical indicators confirm malicious intent.

Technical telemetry shows the domain was created on February 21 2026 and registered through PT Registrasi Neva Angkasa. It resolves to IP 172.67.148.191 and is hosted via Cloudflare, Inc. (AS13335). The page uses no SSL certificate, increasing suspicion of insecure session handling during active operation. VirusTotal reports 17 of 95 security vendors flagging the domain, and it appears on 1 security blocklist with PhishDestroy classification.

Although inactive at present, the domain demonstrates typical patterns of financial brand impersonation campaigns, combining trusted CDN infrastructure with deceptive naming to increase credibility. Users who interacted with the page should assume credential compromise risk and immediately reset any affected credentials. Defensive actions include blocking the domain and associated subdomains, monitoring Cloudflare-resolved IP reuse for similar campaigns, and deploying detection rules for DANA brand abuse patterns. Security teams should also track newly registered domains under similar naming conventions to prevent reuse in follow-up attacks.