aktiifkaan-paylaterrsx4[.]resmi-onz3[.]xyz

This domain aktiifkaan-paylaterrsx4.resmi-onz3.xyz is assessed as a generic phishing infrastructure targeting users through brand impersonation of the DANA payment service. The page title “DANA - Apa pun transaksinya selalu ada DANA” indicates an attempt to mimic legitimate financial transaction interfaces in order to trick users into entering sensitive credentials or payment-related authentication data. The structure of the domain, combining randomized prefixes with a layered subdomain, is consistent with disposable phishing kits designed for rapid deployment and rotation.

Technical indicators confirm malicious intent across multiple telemetry sources. VirusTotal reports 18/95 security vendors flagging the domain as malicious. The domain was registered on March 01, 2026 via Dynadot LLC and resolves to 172.67.176.26 under AS13335 (Cloudflare, Inc.). It currently appears on 1 security blocklist and has no SSL certificate, which further increases suspicion of insecure credential harvesting infrastructure. The domain is also classified as generic phishing with no evidence of legitimate service hosting.

The domain is currently taken offline, indicating partial disruption of the campaign. However, historical exposure still presents risk if users interacted with the page prior to takedown. Any credentials or payment information entered should be considered compromised, especially for financial accounts tied to DANA. Users should monitor account activity for unauthorized transactions, reset passwords, and enable multi-factor authentication where possible. Given the 18/95 detection ratio, absence of SSL, and confirmed impersonation pattern, similar infrastructure variants may still be active and should be continuously monitored.