harta123[.]org

The domain harta123.org was identified as a phishing site engaged in brand impersonation targeting Telegram users. It posed as a legitimate Telegram-related service to deceive victims, though no crypto drainer kit was detected. As of the latest verification, harta123.org has been taken offline, but prior activity classified it as a scam under investigation.

Technical analysis of harta123.org revealed minimal detection at the time of assessment, with 0 of 95 VirusTotal vendors flagging the domain. Google Safe Browsing did not list it as malicious, though it appeared on 1 security blocklist (PhishDestroy). The domain was registered through NameSilo, LLC on May 14, 2023, and resolved to the IP address 162.0.215.222, hosted by Namecheap, Inc. in the US. The SSL certificate was issued by Let's Encrypt (R12), and the observed page title was 'Harta123 | Developer game online terbaru dan terlengkap'. Detected technologies included Nginx, and the domain used Namecheap hosting nameservers (dns1.namecheaphosting.com, dns2.namecheaphosting.com).

Individuals who interacted with harta123.org should take immediate steps to secure their accounts. If credentials were entered, change passwords for Telegram and any other services where the same credentials may have been reused, and enable two-factor authentication (2FA). Monitor accounts for unauthorized activity and report any suspected fraud to Telegram's official support channels. To report the domain, submit it to platforms like Google Safe Browsing, PhishTank, or the registrar (NameSilo) for further action. Victims may also file complaints with local cybercrime authorities or organizations like the Anti-Phishing Working Group (APWG).