danaa-indonesiaxl[.]resmi-bkd3[.]art

The domain danaa-indonesiaxl.resmi-bkd3.art was observed hosting a page titled "DANA – Apa pun transaksinya selalu ada DANA" before being taken offline. The site was registered on 21 April 2025 through Dynadot LLC and is served from the Cloudflare network (AS13335) at IP 104.21.8.2 in the United States. Cloudflare‑provided nameservers dylan.ns.cloudflare.com and kim.ns.cloudflare.com resolve the domain, and the service is configured to use HTTP/3 without an SSL certificate, indicating that HTTPS was not enabled at the time of capture. Threat‑intelligence scanners flagged the domain: 18 of 95 VirusTotal vendors reported malicious activity, and it appears on at least one public blocklist.

Independent reputation services assigned extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The domain is also listed as blocked by PhishDestroy. No additional artifacts such as malware hashes or URL patterns were provided, and the exact phishing workflow remains undocumented because the site is no longer reachable. However, the combination of a brand‑related page title, high detection rate, low reputation scores, and presence on a phishing‑specific blocklist strongly suggests that the domain was being used for a generic phishing campaign targeting users of the DANA financial service.

Defenders should add the domain and its resolved IP address to deny‑list rules, monitor for any re‑registration of the same second‑level domain, and ensure that email and web filters are updated to block references to the domain. Continuous observation of Cloudflare‑associated IP ranges for similar unencrypted sites may help uncover related infrastructure. Organizations using DANA should remind users to verify URLs and to avoid providing credentials on sites lacking valid TLS certificates.