danaa-iindonesiaa[.]utt[.]my[.]id

This domain, danaa-iindonesiaa.utt.my.id, is flagged as a generic phishing site targeting users of the DANA mobile payment platform. Analysis indicates the page mimics DANA's official branding, using the title 'DANA - Apa pun transaksinya selalu ada DANA' to deceive victims into entering login credentials or financial details. No drainer kit signatures were identified, but the site's infrastructure and lack of SSL suggest a credential-harvesting operation typical of phishing campaigns. Technical indicators confirm elevated risk: the domain is detected by 19 out of 95 security vendors on VirusTotal, resolves to IP 104.21.12.44 (Cloudflare, Inc. AS13335), and lacks an SSL certificate. It appears on one security blocklist and is currently hosted under the utt.my.id subdomain, which may serve as a bulletproof or compromised infrastructure. No registrar or creation date metadata was available, and Google Safe Browsing status is unconfirmed, though the domain is blocked by at least one threat intelligence feed. The domain has been taken offline, reducing immediate risk of active exploitation. However, residual threats remain: the infrastructure (Cloudflare IP, lack of SSL) aligns with known phishing patterns, and the subdomain may be reused for future attacks. Users who accessed the site should assume credential exposure, revoke active sessions, and monitor financial accounts for unauthorized transactions. Organizations should update blocklists to include the domain and IP, and investigate related subdomains under utt.my.id for similar threats.