pembatalan-dana-id-paylater[.]vercel[.]app

This domain is flagged as a high-risk credential harvesting scam designed to impersonate PT Espay Dana Indonesia, a legitimate financial service provider. Analysis indicates the threat type is a generic phishing campaign targeting Indonesian users with fraudulent payment cancellation prompts, aiming to harvest login credentials, personal identification details, and financial data. The domain exhibits characteristics consistent with large-scale phishing operations, including the use of social engineering tactics to induce urgency and trust. Infrastructure analysis reveals the domain pembatalan-dana-id-paylater.vercel.app is hosted on Vercel Inc.’s platform, resolving to the IP address 64.29.17.3 under Amazon.com, Inc.’s AS16509 in the United States. Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious, with one confirmed appearance on a security blocklist. The SSL certificate is issued by Google Trust Services (WR1), a common practice among threat actors to lend legitimacy to phishing sites. Despite its active status, the domain remains accessible, indicating a lack of effective takedown measures by the hosting provider or registrar. Mitigation against this threat requires immediate action from both end-users and network administrators. Users should avoid interacting with the domain or entering any credentials on pages hosted under pembatalan-dana-id-paylater.vercel.app. Financial institutions and security teams are advised to implement domain-based blocking at the DNS or proxy level, utilizing the provided IP and domain indicators. Additionally, monitoring for similar patterns—such as subdomains under vercel.app with Indonesian financial keywords—can help preemptively identify related phishing campaigns. Endpoint protection solutions should be updated to recognize the domain and associated SSL certificate fingerprint as malicious.