kupnfstvlrmdn[.]update-date[.]web[.]id

This domain is flagged for hosting a credential phishing campaign targeting users of the DANA ID digital payment platform. Analysis of the page title, "DANA ID | Aktifkan Fiturnya," indicates an attempt to impersonate the legitimate DANA service, tricking users into entering sensitive login credentials. The threat type is specifically credential harvesting, with an elevated risk level due to the domain's active targeting of financial service users and its presence on security blocklists. Infrastructure analysis reveals multiple technical indicators of compromise. The domain kupnfstvlrmdn.update-date.web.id was registered on March 07, 2026, through PT Registrasi Neva Angkasa, a registrar commonly associated with malicious domains. It resolves to the IP address 104.21.26.191, hosted on AS13335 (Cloudflare, Inc.), a network frequently leveraged to obscure malicious infrastructure. The domain lacks an SSL certificate, increasing the likelihood of interception of submitted credentials. Detection metrics further corroborate the malicious nature of this domain: 21 out of 95 security vendors on VirusTotal flag it as malicious, and it appears on at least one security blocklist. The domain has since been taken offline, though prior activity suggests a coordinated effort to harvest credentials. Mitigation steps for organizations and end-users include immediate blocking of the domain and its associated IP address (104.21.26.191) at the network perimeter. Users who may have interacted with this domain should be advised to reset their DANA ID credentials and enable multi-factor authentication (MFA) on their accounts. Security teams should monitor for signs of credential reuse across other platforms, as harvested credentials are often tested against multiple services. Additionally, domain registrars and hosting providers should be notified of abusive infrastructure to facilitate takedown efforts. Proactive measures, such as deploying email filtering rules to block messages containing the domain or similar patterns, can reduce the risk of further exposure.