daanaindoonesiaz[.]resmi-exs[.]my[.]id

daanaindoonesiaz.resmi-exs.my.id is identified as a generic_phishing domain currently active and designed to impersonate the Indonesian digital wallet brand DANA. The page title observed mirrors official branding language to increase user trust and credential harvesting success.

Technical telemetry indicates the domain is flagged by 13 of 95 security engines, suggesting moderate-to-high consensus on malicious intent. It appears on 1 independent blocklist. The host resolves to IP 188.114.96.3, geolocated in the United States and associated with AS13335, a major content delivery network infrastructure provider. TLS configuration uses a certificate issued under a trusted certificate authority profile (WE1).

At present, the domain remains active, increasing the risk of ongoing credential theft and phishing distribution. Given brand impersonation and infrastructure obfuscation via CDN hosting, direct blocking at network edge and DNS filtering is recommended. Users should avoid interacting with the domain, refrain from entering authentication or payment data, and verify official DANA services via known trusted channels. Security monitoring systems should maintain watchlists for similar homograph or subdomain variations under the same parent structure to prevent re-emergence.