api.telegram.org
Classification: Whitelisted
api.telegram.org is a whitelisted (trusted) hostname. Reported by 9 threat sources, last seen 2026-09-02.
Current activity
- Offline — no longer resolving. Last online 2026-09-02 02:37:26.
- Command & Control server — Used by cybercriminals to control victim computers.
- Malware distribution — This indicator is distributing malware.
MITRE ATT&CK associations
Malware families: REDLINE STEALER (S1240) ASYNCRAT (S1087) AGENT TESLA (S0331)
Intrusion sets: TURLA (G0010)
Blacklist sightings showing the 100 most recent of 132
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Phishing | Phishtank | 2026-02-25 12:31:45 | 2026-09-02 02:33:40 | compromised malicious-activity phishing | |
| Agent Tesla | ThreatFox Abuse.ch | 2022-05-31 00:00:52 | 2026-08-20 06:25:04 | malicious-activity | S0331 Agent Tesla |
| Top Popularity Site | Cisco Umbrella | 2022-07-23 01:45:00 | 2026-04-16 00:25:54 | benign | |
| AsyncRAT | ThreatFox Abuse.ch | 2024-06-29 15:27:13 | 2026-01-25 12:59:35 | malicious-activity | S1087 AsyncRAT |
| Unknown malware | ThreatFox Abuse.ch | 2024-07-22 07:19:18 | 2025-10-31 13:55:03 | malicious-activity | |
| wAgentTea | ThreatFox Abuse.ch | 2025-10-12 06:41:54 | 2025-10-12 06:41:54 | malicious-activity | |
| Unknown Stealer | ThreatFox Abuse.ch | 2025-05-23 12:17:10 | 2025-10-10 08:01:07 | malicious-activity | |
| Phishing Internal Revenue Service | Phishtank | 2025-10-03 10:40:15 | 2025-10-03 11:40:54 | compromised malicious-activity | |
| XWorm | ThreatFox Abuse.ch | 2023-12-30 11:17:11 | 2025-10-03 08:24:37 | malicious-activity | |
| MASS Logger | ThreatFox Abuse.ch | 2025-09-22 06:17:07 | 2025-09-22 06:17:07 | malicious-activity | |
| Prynt Stealer | ThreatFox Abuse.ch | 2025-09-02 06:17:46 | 2025-09-02 06:17:46 | malicious-activity | |
| Stealerium | ThreatFox Abuse.ch | 2025-06-13 13:17:04 | 2025-06-13 13:17:04 | malicious-activity | |
| Snake | ThreatFox Abuse.ch | 2025-05-13 14:17:06 | 2025-05-13 14:17:06 | malicious-activity | G0010 Turla |
| Malware Download | URLhaus Abuse.ch | 2022-04-11 19:15:22 | 2025-03-07 23:33:03 | malicious-activity | |
| 404 Keylogger | ThreatFox Abuse.ch | 2023-05-15 18:17:43 | 2024-07-11 06:18:50 | malicious-activity | |
| Phemedrone Stealer | ThreatFox Abuse.ch | 2024-02-15 14:17:13 | 2024-02-15 14:17:13 | malicious-activity | |
| Malicious URL | Hybrid-Analysis | 2023-07-21 15:22:29 | 2024-01-10 16:00:04 | ||
| RedLine Stealer | ThreatFox Abuse.ch | 2023-05-28 07:17:39 | 2023-05-31 07:19:47 | malicious-activity | S1240 RedLine Stealer |
| Raccoon | ThreatFox Abuse.ch | 2023-05-27 19:17:41 | 2023-05-27 19:17:41 | malicious-activity | |
| Malicious url | 2022-08-21 02:35:07 | 2022-09-14 03:18:23 | malicious-activity | ||
| Safe Site | Cisco Umbrella | 2022-07-15 00:00:19 | 2022-07-15 00:00:19 | benign | |
| IRS phishing | Antiphishing.com.ar | 2022-02-18 01:03:06 | 2022-02-18 01:03:06 | ||
| Malware | Hybrid-Analysis | 2021-06-02 06:15:10 | 2022-01-24 19:30:37 | ||
| IL:Trojan.MSILZilla | Hybrid-Analysis | 2021-07-13 00:30:42 | 2022-01-22 21:00:21 | ||
| BehavesLike.Win64.Ransom | Hybrid-Analysis | 2022-01-21 18:00:38 | 2022-01-21 18:00:38 | ||
| Gen:Variant.Bulz | Hybrid-Analysis | 2020-09-23 08:00:08 | 2022-01-21 02:30:26 | ||
| Trojan.Generic | Hybrid-Analysis | 2018-04-18 06:30:35 | 2022-01-18 11:30:23 | ||
| Trojan.Uztuby | Hybrid-Analysis | 2020-11-23 20:00:29 | 2022-01-17 21:00:11 | ||
| AGEN.1211367 | Hybrid-Analysis | 2022-01-17 09:30:56 | 2022-01-17 09:30:56 | ||
| Gen:Variant.Razy | Hybrid-Analysis | 2020-02-17 00:15:07 | 2022-01-15 00:30:28 | ||
| Gen:Variant.Lazy | Hybrid-Analysis | 2022-01-10 19:15:49 | 2022-01-10 19:15:49 | ||
| MSIL.Downloader | Hybrid-Analysis | 2022-01-09 14:15:06 | 2022-01-09 14:15:06 | ||
| Trojan.Fsysna | Hybrid-Analysis | 2021-08-04 21:00:28 | 2021-12-20 15:45:24 | ||
| Kryptik.ali2000016 | Hybrid-Analysis | 2021-07-30 15:00:33 | 2021-12-20 14:30:48 | ||
| MSIL_Kryptik.GGB.gen | Hybrid-Analysis | 2021-12-09 18:45:06 | 2021-12-09 18:45:06 | ||
| Gen:Variant.Graftor | Hybrid-Analysis | 2021-04-21 12:30:19 | 2021-12-06 15:17:11 | ||
| Gen:Variant.Fugrafa | Hybrid-Analysis | 2021-12-05 08:15:17 | 2021-12-05 08:30:24 | ||
| Dropped:Generic.Malware.SLlg | Hybrid-Analysis | 2021-11-26 14:00:45 | 2021-11-26 14:00:45 | ||
| Trojan.MSIL.Shelpak.4 | Hybrid-Analysis | 2021-11-25 07:45:10 | 2021-11-25 07:45:10 | ||
| Malware.Generic | Hybrid-Analysis | 2019-10-11 21:30:08 | 2021-11-17 14:30:53 | ||
| MSIL.Trojan | Hybrid-Analysis | 2021-11-17 07:45:28 | 2021-11-17 07:45:28 | ||
| HEUR:PSWTool.Python.LaZagne | Hybrid-Analysis | 2020-06-09 16:30:46 | 2021-11-13 01:30:23 | ||
| Trojan.Bingoml | Hybrid-Analysis | 2021-11-12 07:00:18 | 2021-11-12 07:00:18 | ||
| HEUR:Backdoor.MSIL.LightStone | Hybrid-Analysis | 2021-11-10 00:17:31 | 2021-11-10 00:17:31 | ||
| Trojan.Downloader.MSIL | Hybrid-Analysis | 2021-11-08 21:00:06 | 2021-11-08 21:00:06 | ||
| Riskware | Hybrid-Analysis | 2021-09-29 09:00:12 | 2021-10-21 13:31:22 | ||
| Gen:Variant.Ransom.Hydra | Hybrid-Analysis | 2021-10-16 18:15:08 | 2021-10-16 18:15:08 | ||
| Artemis | Hybrid-Analysis | 2019-10-26 17:45:14 | 2021-10-15 01:45:18 | ||
| Gen:Variant.MSILPerseus | Hybrid-Analysis | 2019-09-09 11:15:12 | 2021-10-06 21:30:35 | ||
| Ransom.Win64.BLACKKINGDOM | Hybrid-Analysis | 2021-09-29 09:15:28 | 2021-09-29 09:15:28 | ||
| Sabsik.C4656608 | Hybrid-Analysis | 2021-09-29 04:45:32 | 2021-09-29 04:45:32 | ||
| Gen:NN.ZemsilF.34170 | Hybrid-Analysis | 2021-09-28 16:30:23 | 2021-09-28 16:30:23 | ||
| Gen:Trojan.Heur.AutoIT | Hybrid-Analysis | 2019-07-10 14:15:35 | 2021-09-22 03:15:07 | ||
| FileRepMalware | Hybrid-Analysis | 2021-09-22 03:00:52 | 2021-09-22 03:00:52 | ||
| Kryptik.WEA | Hybrid-Analysis | 2021-09-20 20:00:18 | 2021-09-20 20:00:18 | ||
| Gen:Trojan.Mardom.MN | Hybrid-Analysis | 2021-09-15 23:15:32 | 2021-09-15 23:15:32 | ||
| Greedy.80a3f5e8 | Hybrid-Analysis | 2021-09-06 19:45:08 | 2021-09-06 21:17:17 | ||
| Malicious site | Hybrid-Analysis | 2020-04-06 07:15:16 | 2021-08-05 20:46:08 | ||
| Gen:Variant.Symmi | Hybrid-Analysis | 2019-07-25 15:45:57 | 2021-08-04 22:00:24 | ||
| Trojan.MSIL.Basic.8 | Hybrid-Analysis | 2021-06-11 13:45:58 | 2021-07-29 10:00:47 | ||
| UDS:Backdoor.MSIL.Remcos | Hybrid-Analysis | 2021-07-27 13:17:40 | 2021-07-27 13:17:40 | ||
| Unsafe.AI_Score_100% | Hybrid-Analysis | 2021-07-21 13:15:46 | 2021-07-21 13:15:46 | ||
| Trojan.MSIL.Basic.6 | Hybrid-Analysis | 2021-07-07 19:00:54 | 2021-07-07 19:00:54 | ||
| MSIL_Kryptik.EQS.gen | Hybrid-Analysis | 2021-06-30 13:45:52 | 2021-06-30 13:45:52 | ||
| Gen:Variant.Nemesis | Hybrid-Analysis | 2021-06-16 20:02:00 | 2021-06-16 20:02:00 | ||
| Generic.Malware | Hybrid-Analysis | 2018-05-02 01:15:31 | 2021-04-30 10:45:30 | ||
| Generic.MSIL.DownloaderB | Hybrid-Analysis | 2021-04-24 17:15:07 | 2021-04-24 17:15:07 | ||
| Trojan.Rasftuby.Gen | Hybrid-Analysis | 2021-04-11 13:30:10 | 2021-04-11 13:30:10 | ||
| Backdoor.Poison | Hybrid-Analysis | 2020-11-25 00:00:10 | 2021-01-17 06:30:46 | ||
| Ransom.Ransom.oa | Hybrid-Analysis | 2021-01-14 13:01:05 | 2021-01-14 13:01:05 | ||
| Kryptik.ZEU | Hybrid-Analysis | 2021-01-11 21:30:20 | 2021-01-11 21:30:20 | ||
| HEUR:Monitor.Python.KeyLogger | Hybrid-Analysis | 2020-09-09 17:00:16 | 2021-01-09 16:15:43 | ||
| Trojan.PSW.Python | Hybrid-Analysis | 2020-12-24 21:00:12 | 2020-12-24 21:00:12 | ||
| Wacapew.C | Hybrid-Analysis | 2020-12-18 14:30:07 | 2020-12-18 14:30:07 | ||
| AGEN.1138205 | Hybrid-Analysis | 2020-12-11 23:15:38 | 2020-12-11 23:15:38 | ||
| Kryptik.YQQ | Hybrid-Analysis | 2020-11-18 16:15:56 | 2020-11-18 16:15:56 | ||
| Gen:Variant.Strictor | Hybrid-Analysis | 2019-05-11 14:30:05 | 2020-11-17 17:00:17 | ||
| DangerousObject.Multi | Hybrid-Analysis | 2020-11-09 14:30:13 | 2020-11-16 17:15:19 | ||
| AD.AgentTesla | Hybrid-Analysis | 2020-11-12 14:30:27 | 2020-11-12 14:30:27 | ||
| Dropper.MSIL | Hybrid-Analysis | 2020-10-13 14:15:32 | 2020-10-13 14:15:32 | ||
| MemScan:Trojan.PWS | Hybrid-Analysis | 2020-10-10 15:45:07 | 2020-10-10 15:45:07 | ||
| Trojan.PWS.Stealer | Hybrid-Analysis | 2020-09-30 04:30:27 | 2020-09-30 04:30:27 | ||
| Trojan.Scar | Hybrid-Analysis | 2020-09-05 13:30:11 | 2020-09-08 19:15:20 | ||
| Trojan.MSIL | Hybrid-Analysis | 2020-08-26 14:00:24 | 2020-08-26 14:00:24 | ||
| MSIL_Troj.NT.gen | Hybrid-Analysis | 2020-08-06 00:15:12 | 2020-08-07 21:00:17 | ||
| Gen:Application.Heur | Hybrid-Analysis | 2018-09-09 18:15:11 | 2020-08-04 15:00:50 | ||
| Win64:Malware | Hybrid-Analysis | 2020-07-21 09:45:16 | 2020-07-21 09:45:16 | ||
| Alexa Top 1 Million | Maltiverse Research Team | 2020-07-08 05:42:50 | 2020-07-08 05:42:50 | ||
| Gen:Variant.Ursu | Hybrid-Analysis | 2019-11-16 03:15:06 | 2020-06-29 09:30:20 | ||
| VB.PwShell.11 | Hybrid-Analysis | 2020-06-19 16:30:05 | 2020-06-19 16:30:05 | ||
| Gen:NN.ZedlaF.34128 | Hybrid-Analysis | 2020-06-18 03:00:06 | 2020-06-18 03:00:06 | ||
| Crypt.XPACK | Hybrid-Analysis | 2020-06-12 14:00:05 | 2020-06-12 14:00:05 | ||
| HW32.Packed | Hybrid-Analysis | 2020-05-03 12:45:14 | 2020-05-03 12:45:14 | ||
| Nymeria.E.gen | Hybrid-Analysis | 2020-04-27 12:17:06 | 2020-04-27 12:17:06 | ||
| Trojan.Stealer | Hybrid-Analysis | 2019-03-16 00:45:04 | 2020-04-14 08:45:10 | ||
| Trojan.Script.Vbs | Hybrid-Analysis | 2020-03-23 20:45:05 | 2020-03-24 09:30:04 | ||
| Malware site | Hybrid-Analysis | 2020-03-23 20:15:08 | 2020-03-23 20:15:08 | ||
| MSIL_Agent.BCR.gen | Hybrid-Analysis | 2020-03-20 19:15:27 | 2020-03-20 19:15:27 | ||
| Trojan.Autoit | Hybrid-Analysis | 2020-02-01 09:15:04 | 2020-02-01 09:15:04 | ||
| Generic PWS.y | Hybrid-Analysis | 2020-01-26 01:30:04 | 2020-01-26 01:30:04 |
Tags
agent tesla agentesla agenttesla negasteal arabmoneyttfbot infostealer redline telegram raccoon sdcprodbot vidar mohazo raccoonstealer racealer racoon snakekeylogger 404keylogger snake keylogger twitter https://twitter.com/reecdeep/status/1569255181916700672 https://twitter.com/reecdeep/status/1560646823089283073 malware_download phishing ransomware bo0king-blogspot-com bookingpdf nigalulli htlfeb24 ov3r_stealer rat asyncrat crowdstrike handala hatef wiper braodo xworm 18january2025 iocbottest 22january2025 25january2025 28january2025 8february2025 c2 16february2025 21february2025 27february2025 1march2025 donutloader 18march2025 28march2025 14april2025 collection discovery execution spyware stealer 6may2025 ekans snakehose 20may2025 stealerium 29june2025 16july2025 6august2025 15august2025 prynt urlquery 13september2025 17september2025 24september2025 3october2025 agentttesla 10october2025 wagent 14october2025 7november2025 1january2026 24january2026IP addresses resolved by this hostname
- 149.154.167.197 (2017-10-30 18:30:52)
- 149.154.167.200 (2017-10-30 18:30:52)
- 149.154.167.199 (2017-10-30 18:30:52)
- 149.154.167.198 (2017-10-30 18:30:52)
- 108.160.166.253 (2021-03-08 07:50:01)
- 108.160.172.204 (2021-09-20 05:22:14)
- 149.154.167.119 (2014-10-07 00:00:00)
- 149.154.167.99 (2019-12-13 10:26:33)
- 173.240.5.13 (2013-12-18 00:00:00)
- 173.240.5.14 (2013-10-08 00:00:00)
- 202.160.128.14 (2021-03-10 22:38:49)
- 31.13.73.1 (2020-05-05 00:39:22)
- 149.154.167.220 (2025-12-14 16:33:50)
- 2001:67c:4e8:f004::9 (2026-07-14 03:24:23)
- 149.154.166.110 (2026-07-14 03:24:23)
Whois information
- AS name
- AS62041 Telegram Messenger Network
- Domain
- telegram.org
- TLD
- org
- DNSSEC
- ['unsigned']
- Nameservers
- ns-cloud-b1.googledomains.com, ns-cloud-b4.googledomains.com, ns-cloud-b2.googledomains.com, ns-cloud-b3.googledomains.com, NS-CLOUD-B1.GOOGLEDOMAINS.COM, NS-CLOUD-B2.GOOGLEDOMAINS.COM, NS-CLOUD-B3.GOOGLEDOMAINS.COM, NS-CLOUD-B4.GOOGLEDOMAINS.COM
- Whois server
- whois.godaddy.com
- Registrant
- GoDaddy.com, LLC
- Address
- REDACTED
- City
- REDACTED
- State
- Arizona
- Country
- US — United States 🇺🇸
- Contact email
- [email protected], [email protected], [email protected]
- Domain created
- 2003-12-15 14:48:05
- Domain expires
- 2031-12-15 14:48:05
- First indexed
- 2017-10-30 18:30:52
- Last updated
- 2026-09-02 02:39:11