telegram.org - URL scan, 15 Aug 2026
MalwareAnalyzer by Cyble scanned telegram.org and returned a benign verdict (score 0). The page resolved to 149.154.167.99 on Telegram Messenger Network in NL. The domain was registered 8278 days ago through GoDaddy.com, LLC. 7 domains and 1 IP were contacted, over 3 HTTP requests. 15 malware samples communicate with this URL (Mirai, Zbot, Gafgyt, Fareit). The request followed 1 redirect before landing. This is a point-in-time observation from 15 Aug 2026; the page may have changed since.
Scan result
- Verdict: benign (score 0) · Confidence 8%
- Scanned URL:
https://t.me/ - Domain: telegram.org · IP: 149.154.167.99 · AS62041 · NL
- Server: nginx/1.30.1
- Page title: Telegram Messenger
- HTTP status: 200 · text/html; charset=utf-8
- Registrar: GoDaddy.com, LLC · domain age 8278 days · created 2003-12-15
- TLS issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2 · valid to Sep 12 13: · subject CN=*.telegram.org
- HTTP requests captured: 3
- Scan tier: fast · observed 2026-08-15 06:57:20 UTC
Redirect chain
https://t.me/https://telegram.org/
Malware communicating with this URL (15)
These samples were observed contacting or being served from telegram.org. Each links to its full analysis.
- Mirai - referenced ·
b284282059d0cbf9f7640624ae54b570· first seen 2026-08-15 - Mirai - referenced ·
9f11e24531de2a3e5de458d335485805· first seen 2026-08-14 - Mirai - referenced ·
6d99352ccf8ef3dec20ee396418f4963· first seen 2026-08-13 - Mirai - referenced ·
6ae2d6cbbd86fc97aaf932ed79fb683e· first seen 2026-08-13 - Mirai - referenced ·
5ac57ece78df250d7ced1a49a74b1084· first seen 2026-08-13 - Zbot - referenced ·
c8f5a1032f770a377b3435336d8ff461· first seen 2026-08-13 - jshint.min.js - referenced ·
66d1da5898b2155ec5db102da7236411· first seen 2026-08-12 - Mirai - referenced ·
436f164de1640f910005be2aa5e9c034· first seen 2026-08-12 - Gafgyt - referenced ·
406a984d952108f1d06e42046a354b4c· first seen 2026-08-12 - 3fed685e1b41d37f28a2fbd69ee3755ab4797b5d9b60ca6d904b2c9529af12f8.exe - contacted ·
3fed685e1b41d37f28a2fbd69ee3755a· first seen 2026-08-12 - 3e497c4592235f88cca567e99819a0a1dfd7c48cf58e409accafe298abe02cbf.exe - contacted ·
3e497c4592235f88cca567e99819a0a1· first seen 2026-08-11 - Fareit - referenced ·
77232accc7b545041145a8d1b1c7ebd4· first seen 2026-08-11 - 3d6b24a04634f0f724a119d596491942f281f7fd4c36aea10daf427c91fb93fa.exe - contacted ·
3d6b24a04634f0f724a119d596491942· first seen 2026-08-11 - Yogi - contacted ·
3d017e38a7f64f59bcfff462d68327a0· first seen 2026-08-11 - Yogi - contacted ·
373ca0a0e89006ec968611fb0c15a569· first seen 2026-08-11
Antivirus & YARA (0 of 44 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Hosted on abuse-prone infrastructure (telegram)
Detected technologies
- Nginx
- Bootstrap
Contacted infrastructure
- 149.154.167.99 - AS62041 Telegram Messenger Network (Netherlands)
Observed indicators
- telegram.org
- x.com
- core.telegram.org
- desktop.telegram.org
- macos.telegram.org
- translations.telegram.org
- instantview.telegram.org
- 149.154.167.99
- https://telegram.org/
- https://telegram.org/img/website_icon.svg?4
- https://telegram.org/img/apple-touch-icon.png
- https://telegram.org/img/favicon-32x32.png
- https://telegram.org/img/favicon-16x16.png
- https://telegram.org/img/favicon.ico
- https://telegram.org/css/bootstrap.min.css?3
- https://telegram.org/css/telegram.css?254
- https://telegram.org/css/telegram-theme.css?7
- https://telegram.org/?setln=en
- https://telegram.org/?setln=id
- https://telegram.org/?setln=ms
Other scans of telegram.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - benign ·
https://core.telegram.org/bots - 23 Aug 2026 - benign
- 22 Aug 2026 - benign ·
https://core.telegram.org/bots - 22 Aug 2026 - benign ·
https://core.telegram.org/bots - 22 Aug 2026 - unknown ·
https://proxy-telegram.543333.xyz/ - 22 Aug 2026 - unknown ·
https://proxy-telegram.dwork.workers.dev/ - 22 Aug 2026 - suspicious ·
https://google.g55xka0q.com/download - 22 Aug 2026 - suspicious ·
https://googlex.u9m9e1.com/unAvailable.html - 22 Aug 2026 - benign ·
https://core.telegram.org/bots - 22 Aug 2026 - unknown ·
https://worker-old-credit-fcad-telegram.simi.workers.dev/
Questions about telegram.org
- Is telegram.org safe?
- The scan of telegram.org on 15 Aug 2026 found no evidence of harm. That is the absence of a finding at one point in time, not a guarantee: a page can change, and a scan only sees what it was served.
- What malware is associated with telegram.org?
- 15 analysed samples communicate with this URL, including Mirai, Zbot, Gafgyt, Fareit.
- How was telegram.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of telegram.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan