indonesiaxs-dnapaylltern[.]confirenews[.]com

This domain, indonesiaxs-dnapaylltern.confirenews.com, is identified as a credential theft scam targeting users of the DANA digital payment platform. Analysis of the page title, '𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔,' indicates an attempt to impersonate the legitimate DANA customer support interface. The goal is to deceive users into entering sensitive login credentials, financial details, or personal information under the guise of resolving account issues or accessing support services. Such stolen credentials are typically exploited for unauthorized transactions, identity theft, or sold on underground markets for further malicious activities. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. It is flagged by 20 out of 95 security vendors on VirusTotal, including detection as a phishing or credential theft site. The domain was registered on March 06, 2026, through CV. Rumahweb Indonesia, and appears on one security blocklist. It resolves to the IP address 172.67.158.138, hosted on Cloudflare’s network (AS13335), a common tactic to obfuscate the true origin of the malicious infrastructure. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security, as encrypted connections do not guarantee legitimacy. The domain’s recent creation date and use of Cloudflare further align with patterns observed in short-lived phishing campaigns designed to evade detection. Users who have visited indonesiaxs-dnapaylltern.confirenews.com or interacted with its content should take immediate action to mitigate potential risks. First, disconnect the device from the network to prevent further data exfiltration if credentials were entered. Reset passwords for any accounts accessed or entered on the site, prioritizing financial and email accounts, and enable multi-factor authentication where available. Monitor linked bank accounts, credit reports, and transaction histories for unauthorized activity. If financial details were provided, contact the relevant institution to report potential fraud and request account monitoring or freezing. Scan the device with updated security tools to detect and remove any malware or persistent threats. Finally, report the domain to local cybersecurity authorities or platforms like the Anti-Phishing Working Group to aid in broader mitigation efforts.