pengembalian-dana[.]lazada[.]xx[.]kg

Analysis indicates that the domain pengembalian-dana.lazada.xx.kg was registered on 3 May 2025 and is presently offline. The domain resolves to the Cloudflare address 104.21.76.69, which is advertised as being located in the United States under ASN 13335. No TLS certificate is presented, meaning HTTPS connections would be unencrypted. The authoritative nameservers listed are ns1.digitalplat.org, ns2.digitalplat.org, and ns3.digitalplat.org.

The page title retrieved during scanning reads “🎁 𝗗𝗔𝗡𝗔 INDONESIA 🎁”, and the domain is classified as an E‑Commerce scam that impersonates the DANA brand. Threat intelligence from PhishDestroy has already blocked the domain, and a single security blocklist currently lists it. Gridinsoft’s proprietary trust score rates the domain at 0 out of 100, reflecting a complete lack of trust. VirusTotal analysis shows that fifteen of ninety‑three scanning engines flag the domain as malicious, reinforcing the suspicion of abusive activity.

The combination of brand impersonation, use of a reputable CDN provider, absence of TLS, and low trust score suggests a purposeful attempt to lure victims by mimicking a legitimate DANA service. Uncertainty remains regarding the exact payload or phishing page content, as no direct content snapshot is available. Defenders should add the domain to network‑level blocklists, monitor DNS queries for the associated IP address and nameserver patterns, and consider sinkholing the Cloudflare IP range if broader mitigation is required. Continuous re‑scanning is advised to detect any future re‑activation, and any newly observed traffic should be correlated with the DANA brand to identify potential credential harvesting attempts.