jelajah138[.]com

Analysis indicates that the domain jelajah138.com was registered through NameSilo, LLC on 22 February 2025. The authoritative nameservers are ns1.jelajah138.com, ns2.jelajah138.com, ns1.ulltahoosstt.buzz and ns2.ulltahoosstt.buz, suggesting an attempt to use both brand‑aligned and unrelated name servers. DNS resolution points to IP 31.57.243.207, which is associated with AS262287 owned by Latitude.sh LTDA and geolocated to the United States. No TLS certificate is present, and the site is currently offline, limiting immediate content inspection. The page title retrieved from historical records reads “Jelajah138 - Jelajah138 Mobile Legends Patch Notes Hero Terbaru,” which does not reference the impersonated brand.

However, intelligence categorizes the activity as a brand‑impersonation campaign targeting Telegram, indicating that the underlying content likely attempted to harvest Telegram credentials or lure users with a Telegram‑related lure. VirusTotal has recorded 15 detections out of 93 scanning engines, reflecting moderate malicious classification across multiple vendors. The domain appears on a single security blocklist and has been specifically blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. AlienVault OTX references the domain in 19 separate threat‑intel pulses, providing additional community corroboration of its abusive nature.

Uncertainty remains regarding the exact payload or user‑experience because the site is offline and the page title does not directly mention Telegram. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host or its IP range, and add the domain to internal blacklists. Continuous observation of the associated IP address and related name‑server patterns is advised, as the attacker may redeploy the campaign under a new sub‑domain or alternate hosting.