idnsyy[.]crzyy[.]my[.]id

Analysis of idnsyy.crzyy.my.id indicates a confirmed brand‑impersonation campaign targeting the Indonesian digital wallet service DANA. The domain was registered on 23 October 2025 through PT JC Indonesia and is hosted on Cloudflare’s network (ASN 13335) with the address 172.67.176.133 located in the United States. DNS records show the authoritative name servers jake.ns.cloudflare.com and keira.ns.cloudflare.com, confirming the Cloudflare front‑end. No TLS certificate is presented, and the site currently returns an offline HTTP status, consistent with the “taken offline” indicator in the intelligence feed. The page title returned by the web server is “DANA - Apa pun transaksinya selalu ada DANA”, directly referencing the target brand and matching the declared scam type of brand impersonation.

The site is listed on one external security blocklist and has been actively blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 16 of 93 scanning engines have flagged the domain as malicious, reinforcing the malicious disposition. The evidence set confirms that the infrastructure is typical of fast‑flux or abuse‑of‑legitimate CDN services, relying on Cloudflare to mask the true origin. While the site is presently offline, the domain may be re‑activated in the future, and the same hosting configuration could be reused for other impersonation campaigns. No SSL/TLS certificate is observed, which eliminates the possibility of certificate‑based trust for users.

Defenders should continue to block the domain at perimeter filters, update URL and domain reputation lists, and monitor Cloudflare‑associated IP ranges for similar patterns. Incident response teams should verify that any internal DANA‑related login attempts are directed to legitimate endpoints and consider adding the domain to deny‑list rules in web‑proxy and endpoint protection solutions.