atokk918-pixel[.]github[.]io

This domain, atokk918-pixel.github.io, is flagged as a high-risk credential phishing site targeting users of the DANA digital payment platform. Analysis of the page title, DANA - Pusat Bantuan, indicates an attempt to impersonate the official DANA customer support portal, likely designed to harvest login credentials, personal information, or financial details from unsuspecting victims. The use of a GitHub Pages subdomain suggests an effort to exploit trusted infrastructure for malicious purposes, a common tactic in phishing campaigns to evade initial suspicion and reduce hosting costs. No explicit drainer kit signatures were identified in preliminary analysis, though further forensic examination of the page source and network requests would be required to confirm the presence of automated credential theft mechanisms. Infrastructure analysis reveals several critical technical indicators associated with this domain. The domain is registered through GitHub, Inc., and resolves to the IP address 185.199.110.153, which is geolocated in the United States under AS54113 (Fastly, Inc.). Security vendor detections on VirusTotal report 8 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The domain is currently blocked by PhishDestroy, a known phishing mitigation service. The SSL certificate is issued by Let's Encrypt (R12), which, while providing encryption, does not validate the legitimacy of the site content. No creation date was provided in the available intelligence, but the domain remains active and operational, indicating ongoing malicious activity. The current status of atokk918-pixel.github.io is active, with no evidence of takedown or remediation at the time of this assessment. The domain continues to resolve and serve content, posing a persistent risk to users who may encounter it through phishing links distributed via email, social media, or malicious advertisements. Response actions should include immediate reporting to GitHub for abuse mitigation, as well as submission to additional security blocklists and browser-based phishing protection systems. Users are advised to avoid interacting with the domain, verify the authenticity of any DANA-related communications through official channels, and employ multi-factor authentication to mitigate the risk of credential compromise. Despite existing detections, the domain's continued operation underscores the need for heightened vigilance and proactive monitoring of similar threats targeting financial platforms.