danaiindonesia4[.]yxdb[.]my[.]id

Analysis indicates that the domain danaiindonesia4.yxdb.my.id was registered on 21 February 2026 and subsequently resolved to the IP address 172.67.198.4, which belongs to Cloudflare (AS13335) and is geolocated in the United States. The site is currently offline, but historical evidence shows it was serving a page with the title “DANA - Apa pun transaksinya selalu ada DANA”, a phrase associated with the DANA financial service. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal scans returned 14 positive detections out of 93 participating vendors, confirming that multiple anti‑malware engines consider the site malicious.

The SSL certificate is listed as “WE1”, and the Gridinsoft trust score was recorded at 0 out of 100, indicating a lack of trust. These indicators collectively point to a generic phishing operation targeting users of the DANA brand. Uncertainty remains regarding the exact payload or credential‑harvesting mechanism because no page content beyond the title has been disclosed, and the site is no longer reachable for live analysis.

Defenders should treat the domain as malicious: add the FQDN to DNS‑based blocklists, enforce HTTP/HTTPS filtering, and monitor for any new sub‑domains or similarly structured registrations that reference “danaiindonesia” or the DANA brand. Since the hosting infrastructure is shared with many legitimate services on Cloudflare, network‑level detection should rely on the specific IP address and the observed TLS fingerprint rather than generic Cloudflare traffic. Ongoing threat‑intel feeds should be consulted for emerging indicators related to this campaign.