tukaarpoiints-danaax4[.]resmi-cxhh[.]my[.]id

Analysis of the domain tukaarpoiints-danaax4.resmi-cxhh.my.id indicates it was actively used in a phishing campaign targeting users of the DANA digital payment platform. The domain was registered on April 16, 2025, through PT Registrasi Neva Angkasa, a registrar commonly associated with domains in Indonesia. Infrastructure analysis reveals the domain resolved to the IP address 172.67.175.53, hosted on Cloudflare's network (AS13335), a configuration often leveraged by threat actors to obscure origin servers and evade takedowns. The domain utilized Cloudflare nameservers (mario.ns.cloudflare.com and vita.ns.cloudflare.com), further supporting the use of Cloudflare services for anonymization.

No SSL certificate was detected for this domain, increasing the likelihood of interception or manipulation of unencrypted traffic. The page title, 'DANA - Apa pun transaksinya selalu ada DANA,' explicitly references DANA, a prominent Indonesian digital wallet service, confirming the intended impersonation. As of the latest scans, the domain was flagged by 10 of 95 security vendors on VirusTotal, a detection rate consistent with known phishing infrastructure. Additionally, the domain appears on at least one security blocklist and was blocked by PhishDestroy, a specialized anti-phishing service.

The domain was taken offline prior to July 25, 2026, though historical infrastructure may still pose residual risks. Defenders are advised to monitor for related domains registered through the same registrar or utilizing similar naming conventions, particularly those incorporating 'dana' or transaction-related keywords. Network-level protections should include blocking the resolved IP (172.67.175.53) and scrutinizing traffic to Cloudflare-hosted domains with Indonesian ccTLDs (.my.id) or subdomains mimicking financial services.