Back to Messaging App Login Code Theft Scam Credential Harvesting

This is a version of Messaging App Login Code Theft Scam in Credential Harvesting.

Fake Indonesian registration page that asks for your Telegram login code and two-step password

An Indonesian-language page titled "Daftar Sekarang" (Register now) says registration for 2026 is open to all people in Indonesia. It asks for your full name as written on your e-KTP identity card and your active Telegram phone number. It then says a code will be sent by an "official Telegram bot" and asks for that 5-digit code, followed by your Telegram two-step verification password. After that it asks for your full address, postal code, province, city and bank name, and tells you to wait 24 hours for an eligibility check. The page never says what you are registering for. It was reported from Indonesia on October 28, 2026, at css4.regnows-dfg[.]com, and the same page was reported on other subdomains of that address since August 21, 2026.

Fake Indonesian registration page that asks for your Telegram login code and two-step password | Screenshot

What’s different in this version

These traits set this message apart from the usual pattern.

  1. The page does not name any program, employer or agency. The banner shows a woman reading a resume with the words "Proses Mudah", "Cepat & Efisien" and "Peluang Terbaik" (easy process, fast and efficient, best opportunity), which suggests a job or opportunity sign-up.

  2. It asks for the Telegram login code and then the Telegram two-step verification password, one after the other, before asking for an address and bank name "for delivery or claim records".

  3. A "Status Pendaftaran (Status Resmi)" (official registration status) list shows first names and Indonesian cities marked as accepted, being checked, or "Autentikasi Gagal" (authentication failed) because the person "forgot the Telegram two-factor authentication password".

  4. The page code sends the phone number to a separate address, elcasp[.]my[.]id, and its internal step names are in Malay rather than Indonesian, which suggests the page was adapted from a Malay-language version.

  5. The same page was reported five times between August 21 and October 28, 2026, on three subdomains of regnows-dfg[.]com (css1, css3 and css4).

Related scams

Other patterns in the same category, or that share a brand with this report.

How this scam works

  1. 1

    Step 1: You open a link to a registration page. It promises a benefit, says places are limited, and often shows a list of other people who have supposedly signed up.

  2. 2

    Step 2: The page asks for your name and the phone number you use for a messaging app such as Telegram.

  3. 3

    Step 3: The page says a code will be sent to you by the app or by an official bot, and asks you to type that code into the page.

  4. 4

    Step 4: If your account has a two-step verification password, the page asks for that too, often saying it is required to finish registering.

  5. 5

    Step 5: The page may then ask for more personal details, such as your address or bank, and tells you to wait while your registration is checked. With your code and password, the people behind the page can sign in to your account.

✓ Do this

  • Treat any page that asks for a code sent by your messaging app as a sign-in attempt on your account, whatever the page says the code is for.
  • Check any program, job or payout on the official website of the organization behind it, by typing the address yourself.
  • If you already typed a code or password into such a page, open the app, end all sessions you do not recognize, and change your two-step verification password.
  • Report the page and the link you received to the messaging app.

✗ Avoid this

  • Do not type a login code from your messaging app into any website or share it with anyone.
  • Do not enter your two-step verification password anywhere except inside the app itself.
  • Do not trust a page because it shows a list of people whose registration was accepted. Anyone can write that list.

Verbatim excerpts from the scam

Exact lines from emails or messages—searchable text so you can compare wording.

  1. 1 Excerpt 1
    Daftar Sekarang 2026, Di buka Untuk Seluruh Masyarakat Indonesia
  2. 2 Excerpt 2
    Nama Lengkap (Sesua E-ktp)
  3. 3 Excerpt 3
    Nomor Telepon (Telegram Aktif)
  4. 4 Excerpt 4
    Kode OTP akan dikirim melalui Bot Telegram Resmi.
  5. 5 Excerpt 5
    Masukkan Kode Verifikasi (5 Digit):
  6. 6 Excerpt 6
    Verifikasi Dua Langkah (2FA) Telegram diperlukan.. Masukkan kata sandi otentikasi dua faktor Telegram Anda.:
  7. 7 Excerpt 7
    Mohon lengkapi informasi untuk keperluan pencatatan pengiriman/klaim..
  8. 8 Excerpt 8
    Harap tunggu proses verifikasi dalam waktu 1x24 jam untuk memeriksa kelayakan, atau gunakan nomor telepon lain.