dagetzzidxty[.]hrvgg[.]biz[.]id

This domain, dagetzzidxty.hrvgg.biz.id, is identified as a generic phishing site targeting users of the Indonesian digital payment service DANA. The page title 'DANA-Apa pun transaksinya selalu ada DANA' directly mimics the legitimate brand’s messaging, a common tactic to deceive victims into entering sensitive credentials. Analysis indicates no evidence of a cryptocurrency drainer kit, suggesting the primary objective is credential harvesting rather than wallet compromise. The domain’s infrastructure and content are designed to exploit trust in the DANA brand, likely targeting Indonesian-speaking users through social engineering tactics such as fake transaction alerts or login prompts. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on March 22, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or a data entry error in registration records. It resolves to the IP address 172.67.133.51, hosted by a content delivery network known for providing anonymity to malicious actors. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The domain lacks an SSL certificate, further reducing its legitimacy and increasing the likelihood of interception of unencrypted data. No association with Google Safe Browsing (GSB) was recorded, though this does not preclude prior or future listings. The domain is currently offline, likely taken down due to detection by security systems or manual intervention. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to takedown. Historical DNS records or cached pages could still pose a threat if accessed inadvertently. Organizations and individuals are advised to block the domain and its associated IP address at the network level, monitor for credential reuse, and educate users on recognizing phishing attempts targeting digital payment platforms. Future iterations of this campaign may reappear under similar domain structures or brand impersonations, necessitating ongoing vigilance in monitoring for related indicators of compromise.