# hamo-telegram-proxy.pages.dev — SUSPICIOUS

> PhishDestroy identifies hamo-telegram-proxy.pages.dev hosting a crypto drainer stealing wallet credentials.

## Summary
PhishDestroy identifies hamo-telegram-proxy.pages.dev as an active credential theft page designed to mimic Telegram’s official proxy service. The fake proxy prompts users to connect crypto wallets, then silently drains funds by exploiting signature requests. The page falsely claims to provide privacy-enhanced Telegram sessions, but in reality, it captures private keys or wallet approvals to execute unauthorized token transfers.  This domain was flagged by PhishDestroy after VirusTotal analysis revealed only 1 out of 95 security vendors detected it on 2024-04-12. It is registered through Cloudflare, Inc. and resolves to IP 188.114.97.3 via a Google Trust Services SSL certificate—a common tactic to appear legitimate. Threat actors often exploit Cloudflare pages.dev subdomains to host short-lived phishing pages that exploit brand recognition.  If you visited hamo-telegram-proxy.pages.dev, disconnect your wallet immediately and revoke any unauthorized approvals via your wallet’s security settings. Do not reconnect to any service linked from unverified sources. Report the domain through PhishDestroy or your security provider, and scan connected devices for malware. Always verify service URLs via official channels before entering private keys or signing transactions.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/b29bd9f1-30ec-4cd6-b271-4b48fa4e81c0
- PhishDestroy: https://phishdestroy.io/domain/hamo-telegram-proxy.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/hamo-telegram-proxy.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/hamo-telegram-proxy.pages.dev/
Last updated: 2026-03-22