Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://pinjaman.barracuda.my.id/
Detected Brand
DANA
Country
International
Confidence
100%
HTTP Status
200
Report ID
b9cf22ad-5fcā¦
Analyzed
2026-03-12 08:24
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1054267A29400541B111641C67657EF4B34C3E2458E7A0851A79543AB7FEF7F09CFF39A |
|
CONTENT
ssdeep
|
192:QS8StSiS7oiwQcYIggT8Le69omlu3sIbyxKDW6gtz3pj0Yk2a:QBWSiS7oiwQ8o1wJe3pj/kB |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e16d43924f671a9a |
|
VISUAL
aHash
|
00c3c3c3ffe7ffff |
|
VISUAL
dHash
|
16169696160f0c00 |
|
VISUAL
wHash
|
0000c3c3c3c3e7ff |
|
VISUAL
colorHash
|
060000001c0 |
|
VISUAL
cropResistant
|
96169696160f0c00,696169795f4ecc0e,0000343430303410,32f0cc73f0ccc828 |
Code Analysis
Risk Score
71/100
Threat Level
ALTO
ā ļø Phishing Confirmed
š£ Credential Harvester
š£ OTP Stealer
š¬ Threat Analysis Report
ā¢ Threat: Phishing
ā¢ Target: DANA users
ā¢ Method: Impersonation and credential harvesting.
ā¢ Exfil: login.php (potential)
ā¢ Indicators: Suspicious domain, JavaScript obfuscation, form actions.
ā¢ Risk: High
š Credential Harvesting Forms
š Obfuscation Detected
- fromCharCode
- unescape
šÆ Kit Endpoints
- login.php
š” API Calls Detected
- POST
š¤ Form Action Targets
- login.php
š Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is not the official DANA domain.
Form Action to Login Page
Form actions targeting a login.php page often indicate credential harvesting.
JavaScript Obfuscation
Obfuscation attempts to hide malicious code from detection.
š¬ Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
DANA users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
HIGH - Automated credential harvesting with HTTP POST to backend
ā ļø Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer
- 4 obfuscation techniques
š¢ Brand Impersonation Analysis
Impersonated Brand
DANA
Official Website
https://dana.id/
Fake Service
DANA loans and promotions
Fraudulent Claims
āļø Attack Methodology
Primary Method: Credential Harvesting
The site attempts to steal DANA login credentials through a fake login page. Users are prompted to enter their information on a form designed to look like a legitimate DANA interface.
Secondary Method: Social Engineering
The website leverages the DANA brand to create a false sense of trust, prompting users to input their information.
š Infrastructure Indicators of Compromise
Domain Information
Domain
pinjaman.barracuda.my.id
Registered
Unknown
Registrar
Unknown
Status
Inactive
š¤ AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
DANA
http://dnanewsnpaylttern.confirenews.com/
Apr 01, 2026
DANA
http://frompayltersdnaid.blackopium.biz.id/
Mar 19, 2026
DANA
https://dnanewsnpaylttern.confirenews.com/
Mar 17, 2026
DANA
http://pinjaman-01.barracuda.my.id/
Mar 12, 2026
DANA
http://indonesiaxs-dnapaylltern.confirenews.com/
Mar 11, 2026
Scan History for pinjaman.barracuda.my.id
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.