website-dana[.]layananid[.]biz[.]id

Analysis of website-dana.layananid.biz.id indicates that the site was operating as a fake exchange platform targeting users of the DANA payment service. The page title “DANA - Apa pun transaksinya selalu ada DANA” was observed before the site was taken offline, confirming the intent to appear affiliated with the legitimate DANA brand. The domain resolves to the Cloudflare‑owned address 188.114.96.3, which is geolocated to Canada. Both authoritative Cloudflare nameservers (gerardo.ns.cloudflare.com, melany.ns.cloudflare.com) are listed, and the site employed Cloudflare services including Browser Insights and HTTP/3.

The TLS certificate was issued by Let’s Encrypt (E7), providing a valid HTTPS connection at the time of collection. Reputation data shows the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scanned the host with 94 AV engines, of which 20 returned a positive detection, reinforcing the malicious classification. The infrastructure footprint is limited to a single IP and the registrar is PT JC Indonesia.

No additional indicators such as Safe Browsing IDs, OTX tags, or threat‑intel feeds were supplied. Uncertainty remains regarding the exact phishing pages that were served, as the site is currently offline and content capture is unavailable. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑hosting on alternative CDNs, and add the IP address 188.114.96.3 to deny lists. Given the confirmed fake exchange nature and the observed vendor detections, the risk rating of elevated is appropriate until the infrastructure is fully remediated.