danaaindoonesia4[.]resmi-lzo3[.]my[.]id

PhishDestroy identifies danaaindoonesia4.resmi-lzo3.my.id as a high-risk crypto-draining phishing site designed to trick users into connecting wallets and silently transferring tokens. This domain lures victims under the guise of a legitimate Indonesian platform, then surreptitiously drains cryptocurrency assets once wallet permissions are granted. Security telemetry shows the page exhibits classic drainer behaviors: rapid DOM manipulation after wallet connection, hidden transaction prompts, and address substitution to attacker-controlled wallets. This domain was flagged by 11 of 95 VirusTotal security vendors, and Google Safe Browsing already classifies it under SOCIAL_ENGINEERING, confirming active abuse. The domain resolves to IP 104.21.5.106 and uses a Google Trust Services SSL certificate to appear reputable. Infrastructure analysis reveals a recently created subdomain (seed 3a10b3) on the my.id free domain service, a known haven for short-lived phishing campaigns. If you visited danaaindoonesia4.resmi-lzo3.my.id, immediately revoke any wallet permissions via your wallet’s connection manager and transfer remaining funds to a new address. Scan all connected devices for malware and monitor transaction histories for unauthorized transfers. Report the domain to PhishDestroy and your wallet provider to help block further abuse.