Phishing | flow-ballet.my

[Igor4er]

What are the subjects of the phishing (domains, URLs or IPs)?

https://flow-ballet.my/

What are the impersonated domains?

telegram.org (login page)

Where or how did you discover this phishing?

I discovered this phishing by one of my friends recieving this link in the DMs.

Do you have a screenshot?

(sorry for url hidden, this is screenshots i made for freinds to warn them and I didn't want them to go to that website)

Related external source

I also reported it everywhere i could, like google safebrowsing, microsoft forgot this thing. I also reported it to the cloudflare and dynadot.
But at this time no one of resources above marked this domain as dangerous

Additional Information or Context

There are two buttons on the main page, after clicking on any of them - website impersonates telegram, and shows QR code. If scan it from phone - your account getting stolen.

Also more on discovery: So one of contacts DMed my friend with proposal to vote in a competition, and when he went to this website he clicked a button, then saw a telegram login. Fortunately he was too lazy to login to the telegram, and is saved him. There's a lot of people who would fall for it. The contact of my friend that sent this to him were deleted from telegram completely on the next day (probably telegram internal measures to prevent things like it).

I don't have capability to check what will happen if you actually scan this qr code, but probably shortly after all other sessions except scammer's sessions will be terminated, and the same message with proposal to vote will be sent to all of the contacts. Additionally scammers will be able to read all your messages, and if you store something critical in the telegram "saved" it could be very dangerous depending on scammer's desire to scam you further.

[phishing-database-bot]

Verification Required

@Igor4er, thank you for submitting a false positive report! To help us verify your ownership of the affected domain(s), please complete the following steps:

1. Set a DNS TXT record for the domain(s) listed in this issue with the following details:

   • Record Name: _phishingdb
   • Record Value: antiphish-9ef1ac726c5690d0256bf1993df39f262fb1aa35

   Your Verification ID: antiphish-9ef1ac726c5690d0256bf1993df39f262fb1aa35

2. Wait for DNS propagation (this may take a few minutes to a few hours).

3. Reply to this issue once the TXT record has been set.

Important Notes

• Verification does not guarantee whitelisting. The Phishing.Database team will review your report after verifying ownership, but the decision to whitelist depends on further investigation and analysis.
• If the record cannot be set or you need alternative methods of verification, please contact us at contact@phish.co.za - preferably from the domain's official email address.

How to Check the TXT Record ?

You can verify that the TXT record is properly set using:

• Online tools like MXToolBox TXT Lookup.
• The command line:

  dig TXT _phishingdb.example.com
  

Thank you for your cooperation! We will address your issue as soon as possible after verification.

The Phishing.Database Project Team.

[Igor4er]

IDK why bot said that i submitted false positive. It's a Phishing website

[spirillen]

IDK why bot said that i submitted false positive. It's a Phishing website

LOL just thought why is even send you this msg...

~~Can I request that you copy this issue to https://github.com/Phishing-Database/phishing/issues/new/choose as we are processing the issue there 😃 ~~

Never mind... recreated the issue here https://kb.mypdns.org/issue/MTX-121161/flow-ballet.my