laporan-customer[.]srtp[.]my[.]id

This domain, laporan-customer.srtp.my.id, is identified as an active phishing site targeting users of the DANA digital payment platform. The page title, 'DANA - Apa pun transaksinya selalu ada DANA,' directly impersonates the legitimate service to deceive victims into submitting sensitive credentials, including login details and financial information. Analysis confirms the domain is currently operational and designed to mimic the appearance of official DANA communications, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain is flagged by 8 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under 'SOCIAL_ENGINEERING.' The domain resolves to the IP address 188.114.97.3, which is associated with Cloudflare’s network, a common tactic to obscure hosting origins and evade detection. Detected technologies include jQuery CDN, jQuery, and HTTP/3, suggesting a modern, responsive phishing kit designed to function across devices. No historical registration data or creation date is publicly available, limiting attribution efforts, but the domain’s active status and low detection count indicate it may still be in the early stages of deployment. The domain remains active as of the latest verification, posing a high risk to users unfamiliar with phishing tactics. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator of compromise (IOC). Users who may have interacted with the site should immediately reset their DANA account credentials, enable multi-factor authentication, and monitor for unauthorized transactions. Security teams should treat this domain as part of a broader credential harvesting campaign and investigate any related network traffic or user reports of suspicious activity.