rumahppr[.]sit-e[.]com

This domain, rumahppr.sit-e.com, is identified as a brand impersonation threat targeting Telegram users under the guise of a housing application scam. The page title, "PERMOHONAN RUMAH PPR 2025," suggests an attempt to deceive users into believing they are accessing a legitimate government or organizational housing request portal. Analysis indicates no direct evidence of a crypto drainer or credential harvester kit, but the domain’s design and targeting align with social engineering tactics commonly used in phishing operations to collect personal information or distribute malware. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 13 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered on October 8, 2025, through CV. Jogjacamp, a registrar frequently associated with low-reputation domains. The domain resolves to the IP address 198.251.89.34, hosted by FranTech Solutions (AS53667), a provider known for bulletproof hosting services. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) flags were recorded at the time of analysis. As of the latest assessment, rumahppr.sit-e.com has been taken offline, likely due to enforcement actions by security providers. However, the underlying infrastructure remains a residual risk, as threat actors may repurpose the IP or registrar for future campaigns. Users who interacted with the domain should monitor for unauthorized access to accounts or personal data. Organizations are advised to block the domain and IP at the network level and conduct retrospective log analysis to identify potential exposure. The use of bulletproof hosting and a registrar with a history of abuse underscores the need for continuous monitoring of related infrastructure.