sultan123[.]org

The domain sultan123.org is a confirmed phishing site engaged in brand impersonation targeting Telegram users. It posed as a legitimate Telegram-related service to deceive victims into disclosing login credentials or other sensitive information, though no crypto drainer kit was detected. As of the latest verification, sultan123.org has been taken offline, but prior activity classified it as an elevated-risk threat.

Technical indicators confirm the domain's malicious nature. sultan123.org was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appeared on 1 security blocklist (PhishDestroy). The domain was registered through NameSilo, LLC on May 23, 2023, and resolved to the IP address 162.0.209.66, hosted by Namecheap, Inc. in the US. No SSL certificate was issued, and the observed page title was 'SULTAN123 : Website Gacor SULTAN 123 Bonus Sultan Menang Besar'. Nameservers were dns1.namecheaphosting.com and dns2.namecheaphosting.com, with a Gridinsoft trust score of 0/100.

Individuals who interacted with sultan123.org should immediately change any passwords associated with Telegram or other accounts accessed during the exposure period. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or messages sent without consent. Report the phishing domain to Telegram’s abuse team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.