osg138[.]org

This domain, osg138.org, is flagged as a brand impersonation threat targeting Telegram, a widely used messaging platform. Analysis indicates the site was designed to deceive users into believing it was an official or affiliated Telegram service, likely for credential theft or unauthorized access to accounts. The page title, 'Osg138 : Dunia Game Inovatif yang Membawa Anda Berjelajah,' suggests an attempt to lure users with gaming-related content, a common tactic to mask malicious intent under seemingly legitimate themes. Infrastructure analysis reveals the domain was registered on December 30, 2023, through NameCheap, Inc. and resolves to the IP address 87.98.238.39. Security vendor assessments on VirusTotal show 3 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and was previously blocked by PhishDestroy. Technologies detected include WordPress, MySQL, PHP, Apache HTTP Server, and AMP, with a Let's Encrypt SSL certificate providing HTTPS encryption, a tactic often used to appear legitimate. The domain is currently offline, reducing immediate risk to users. However, residual threats persist, including potential reuse of the infrastructure or re-registration under a similar name. Organizations and users are advised to monitor for related domains, implement blocklist updates, and verify the authenticity of any communication claiming affiliation with Telegram. Vigilance is recommended, particularly for users who may have interacted with the domain prior to its takedown.