telegram.org - URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned telegram.org and returned a benign verdict (score 0). The page resolved to 149.154.167.99 on Telegram Messenger Network in NL. 7 domains and 1 IP were contacted, over 3 HTTP requests. 22 malware samples communicate with this URL (HUILoader, Zbot, Mirai). The request followed 1 redirect before landing. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: benign (score 0) · Confidence 8%
- Scanned URL:
https://t.me/ - Domain: telegram.org · IP: 149.154.167.99 · AS62041 · NL
- Server: nginx/1.30.1
- Page title: Telegram Messenger
- HTTP status: 200 · text/html; charset=utf-8
- TLS issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2 · valid to Sep 12 13: · subject CN=*.telegram.org
- HTTP requests captured: 3
- Scan tier: fast · observed 2026-08-23 16:57:27 UTC
Redirect chain
https://t.me/https://telegram.org/
Malware communicating with this URL (22)
These samples were observed contacting or being served from telegram.org. Each links to its full analysis.
- HUILoader - contacted ·
1b35868fd50e22825739bf1d0f0fcb17· first seen 2026-08-23 - f5c1380a5ebbe9ebc15216e4d3d5a90d14baad352dc1dd32052861a2e31142e2 - referenced ·
f5c1380a5ebbe9ebc15216e4d3d5a90d· first seen 2026-08-20 - Zbot - referenced ·
8e108830eb08f96c52549dca024c65c6· first seen 2026-08-19 - Mirai - referenced ·
c1e61d32bd277091cf92647cabec47cf· first seen 2026-08-15 - Mirai - referenced ·
be93cf8050a0ec8bc1d142cc6d3106cb· first seen 2026-08-15 - Mirai - referenced ·
bca1a1ab6f8af45dc8b855a33d9fd8bd· first seen 2026-08-15 - Mirai - referenced ·
b5fa45952fa3bb422b1d85d52a6a2969· first seen 2026-08-15 - Mirai - referenced ·
b284282059d0cbf9f7640624ae54b570· first seen 2026-08-15 - Mirai - referenced ·
9f11e24531de2a3e5de458d335485805· first seen 2026-08-14 - Mirai - referenced ·
6d99352ccf8ef3dec20ee396418f4963· first seen 2026-08-13 - Mirai - referenced ·
6ae2d6cbbd86fc97aaf932ed79fb683e· first seen 2026-08-13 - Mirai - referenced ·
5ac57ece78df250d7ced1a49a74b1084· first seen 2026-08-13 - Zbot - referenced ·
c8f5a1032f770a377b3435336d8ff461· first seen 2026-08-13 - jshint.min.js - referenced ·
66d1da5898b2155ec5db102da7236411· first seen 2026-08-12 - Mirai - referenced ·
436f164de1640f910005be2aa5e9c034· first seen 2026-08-12
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Hosted on abuse-prone infrastructure (telegram)
Detected technologies
- Nginx
- Bootstrap
Contacted infrastructure
- 149.154.167.99 - AS62041 Telegram Messenger Network (Netherlands)
Observed indicators
- telegram.org
- x.com
- core.telegram.org
- desktop.telegram.org
- macos.telegram.org
- translations.telegram.org
- instantview.telegram.org
- 149.154.167.99
- https://telegram.org/
- https://telegram.org/img/website_icon.svg?4
- https://telegram.org/img/apple-touch-icon.png
- https://telegram.org/img/favicon-32x32.png
- https://telegram.org/img/favicon-16x16.png
- https://telegram.org/img/favicon.ico
- https://telegram.org/css/bootstrap.min.css?3
- https://telegram.org/css/telegram.css?254
- https://telegram.org/css/telegram-theme.css?7
- https://telegram.org/?setln=en
- https://telegram.org/?setln=id
- https://telegram.org/?setln=ms
Other scans of telegram.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - benign ·
https://core.telegram.org/bots - 22 Aug 2026 - benign ·
https://core.telegram.org/bots - 22 Aug 2026 - benign ·
https://core.telegram.org/bots - 22 Aug 2026 - unknown ·
https://proxy-telegram.543333.xyz/ - 22 Aug 2026 - unknown ·
https://proxy-telegram.dwork.workers.dev/ - 22 Aug 2026 - suspicious ·
https://google.g55xka0q.com/download - 22 Aug 2026 - suspicious ·
https://googlex.u9m9e1.com/unAvailable.html - 22 Aug 2026 - benign ·
https://core.telegram.org/bots - 22 Aug 2026 - unknown ·
https://worker-old-credit-fcad-telegram.simi.workers.dev/ - 21 Aug 2026 - unknown ·
https://telegrambot.hoomancoding.workers.dev/
Questions about telegram.org
- Is telegram.org safe?
- The scan of telegram.org on 23 Aug 2026 found no evidence of harm. That is the absence of a finding at one point in time, not a guarantee: a page can change, and a scan only sees what it was served.
- What malware is associated with telegram.org?
- 22 analysed samples communicate with this URL, including HUILoader, Zbot, Mirai.
- How was telegram.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of telegram.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan