SafeMode - Analysis: aktiifkaanpayllaters.resmi-hkv3.my.id

Visual Capture

Screenshot of aktiifkaanpayllaters.resmi-hkv3.my.id

Detection Info

https://aktiifkaanpayllaters.resmi-hkv3.my.id/

Detected Brand

DANA

Country

Indonesia

Confidence

95%

HTTP Status

200

Report ID

910923d1-a52…

Analyzed

2026-01-25 18:05

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T136F1D8D3E048540A1312C9C1AED7E244F2368717CB56653ADAB650E3F3D9AF4C27A7A2
CONTENT ssdeep	192:Lp3lBluhF1vyYDYV9Hsqu9jZP1N8dPVIq:Lp3lBludyYOdsqojZPv8dtr

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	834973670ce7cc66
VISUAL aHash	00001e3f01ffffff
VISUAL dHash	e2d2f4ecebcecece
VISUAL wHash	0000180f03ffffff
VISUAL colorHash	03003000180
VISUAL cropResistant	f8eceeebcececeea,c072c2d4ececeeeb

Code Analysis

Risk Score 53/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: DANA credential harvesting phishing
• Target: DANA e-wallet users in Indonesia
• Method: Fake website to steal user credentials.
• Exfil: Unknown.
• Indicators: Suspicious domain, obfuscated Javascript, and forms for credential capture.
• Risk: HIGH - Immediate credential theft.

🔒 Obfuscation Detected

fromCharCode

📡 API Calls Detected

POST

📊 Risk Score Breakdown

Total Risk Score

85/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester kit with 4 forms for harvesting user credentials.

Obfuscation Techniques

Identified 4 obfuscation techniques in the JavaScript code, increasing evasion potential.

Brand Impersonation

Impersonates DANA, a legitimate financial service, to deceive users into submitting sensitive information.

Malicious JavaScript

Inclusion of JavaScript file (owl.carousel.js) with potential for malicious activity, though no direct malicious functions extracted.

Lack of Infrastructure Transparency

No associated IPs or nameservers detected, complicating traceability and takedown efforts.

🔬 Comprehensive Threat Analysis

Threat Type

Credential Theft (Fake DANA Login)

Target

DANA users (Indonesia)

Exfiltration Channel

Backend API

🏢 Brand Impersonation Analysis

Impersonated Brand

DANA

Official Website

https://www.dana.id

Fake Service

DANA Paylater and DANA Cicil services

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing kit employs multiple forms to capture user credentials, such as login details, PINs, or other sensitive financial information. The harvested data is likely transmitted to an attacker-controlled server for immediate exploitation or resale on underground markets.

Secondary Method: Brand Impersonation

The campaign mimics DANA's official branding and service offerings, such as DANA Paylater and DANA Cicil, to trick users into believing the site is legitimate and prompting them to enter their credentials.