danaaindonesiia[.]gtzc[.]my[.]id

PhishDestroy identifies danaaindonesiia.gtzc.my.id as an active credential theft phishing domain designed to harvest user login credentials under the guise of an Indonesian platform. The domain mimics a legitimate Indonesian brand to deceive victims, with infrastructure repurposed from known phishing campaigns. While no specific drainer kit fingerprint has been confirmed, behavioral analysis suggests the use of spoofed login portals to harvest credentials for financial or identity-based exploitation.

Technical indicators reveal this domain resolves to IP 104.21.62.165 and operates under a Let's Encrypt SSL certificate, likely to appear legitimate to users. Registered through a subdomain service (my.id), the domain was recently created and shows early-stage malicious activity. VirusTotal scanning confirms detection by 7 out of 95 security vendors, illustrating limited but meaningful coverage. As of the latest assessment, the domain remains unblocked in Google Safe Browsing (GSB) and has not been listed on major blocklists, enabling continued accessibility.

This domain is currently active and poses an elevated risk to unsuspecting users. PhishDestroy recommends immediate network and endpoint blocking of danaaindonesiia.gtzc.my.id, alongside user awareness training to prevent credential exposure. Although detection rates are rising, the lack of widespread blocking increases exposure. All organizations should treat this domain as hostile and monitor for associated indicators of compromise (IOCs) in logs.