aktifkaanpaylattersx[.]lhc[.]my[.]id

Analysis indicates that the domain aktifkaanpaylattersx.lhc.my.id is active and associated with the brand_impersonation threat category. The observed page title matches the impersonated brand, DANA, indicating an attempt to imitate a legitimate online service. No drainer kit information is available from the supplied intelligence. The combination of impersonation indicators, active status, and infrastructure characteristics supports an elevated risk assessment for credential theft or fraudulent transaction workflows.

Technical indicators identify a VirusTotal detection score of 20/95 security vendors. The domain is registered through Cloudflare, Inc. and resolves to IP address 172.67.213.143, located in the US within AS13335 Cloudflare, Inc. No creation date is available from the provided intelligence. The domain has no SSL certificate, appears on 1 security blocklist, and has been blocked by PhishDestroy. These indicators collectively demonstrate externally observed malicious or suspicious behavior consistent with brand impersonation infrastructure.

The domain remains active at the time of assessment, leaving residual exposure for users who encounter links directing to this infrastructure. Recommended response actions include immediate blocking at network, DNS, email, and web gateway layers, continued monitoring for infrastructure changes, and preservation of relevant indicators for incident response and threat hunting. Any interaction with the site should be considered potentially unsafe until independent verification confirms otherwise. The absence of an SSL certificate does not reduce the operational risk, while the existing detection coverage and blocklist presence reinforce the elevated likelihood of malicious use.