pengaajuaann-danaa-paylaateerr[.]armeiza[.]works

Analysis of pengaajuaann-danaa-paylaateerr.armeiza.works indicates a confirmed brand impersonation campaign targeting DANA, a digital payment platform. The domain was registered on May 26, 2025, and resolves to IP address 172.67.197.9, hosted on Cloudflare infrastructure (AS13335) in the United States. No SSL certificate was detected, increasing susceptibility to interception or tampering. The page title, 'DANA - Apa pun transaksinya selalu ada DANA,' directly references the legitimate DANA brand, aligning with the reported scam type of brand impersonation.

The domain is flagged by 13 of 93 security vendors on VirusTotal, with PhishDestroy listing it on one security blocklist. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Current infrastructure analysis reveals the domain is offline, though historical resolution to 172.67.197.9 suggests prior operational use.

Defenders should treat this domain as high-risk for credential harvesting or fraudulent transaction redirection, particularly within regions where DANA is widely used. No evidence of a phishing kit or additional infrastructure links is currently available, though the absence of SSL and use of Cloudflare may indicate attempts to evade detection. Monitoring for re-activation or related domains under the armeiza.works namespace is recommended.