telegramph.188174.xyz - suspicious URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned telegramph.188174.xyz and returned a suspicious verdict (score 48). The page resolved to 104.21.32.8 on Cloudflare, Inc. in US. The domain was registered 919 days ago through Spaceship, Inc.. 5 domains and 4 IPs were contacted, over 23 HTTP requests. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 48) · Confidence 60%
- Scanned URL:
https://telegramph.188174.xyz/ - Domain: telegramph.188174.xyz · IP: 104.21.32.8 · AS13335 · US
- Server: cloudflare
- Page title: Telegraph-Image|免费图床
- HTTP status: 200 · text/html; charset=utf-8
- Registrar: Spaceship, Inc. · domain age 919 days · created 2024-02-13
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Nov 18 01: · subject CN=telegramph.188174.xyz
- HTTP requests captured: 23 · outgoing links: 1
- Scan tier: standard · observed 2026-08-21 11:06:17 UTC
Antivirus & YARA (1 of 47 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- Antivirus/YARA detection in page content: DLV_HTML_Smuggling
- Abuse-heavy TLD .xyz
- Valid TLS, no impersonation or off-origin credential post
- Certificate issued < 48h ago
Detected technologies
- Cloudflare
Contacted infrastructure
- 104.21.32.8 - AS13335 Cloudflare, Inc. (United States)
- 104.16.79.73 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- telegramph.188174.xyz
- github.com
- static.cloudflareinsights.com
- at.alicdn.com
- cn.bing.com
- 104.21.32.8
- 104.16.79.73
- 47.246.41.170
- 150.171.28.10
- https://telegramph.188174.xyz/
- https://telegramph.188174.xyz/favicon.ico
- https://telegramph.188174.xyz/_nuxt/318bf53201c4127c79fc.js
- https://telegramph.188174.xyz/_nuxt/71ef7c30e68aba4a3fc9.js
- https://telegramph.188174.xyz/_nuxt/9e35552f648a5a6a3b24.js
- https://telegramph.188174.xyz/_nuxt/fbd198cfd0f4459e2725.js
- https://telegramph.188174.xyz/_nuxt/b46e75617207ae5013d0.js
- https://github.com/cf-pages/Telegraph-Image
- https://static.cloudflareinsights.com/beacon.min.js/v4513226cdae34746b4dedf0b4dfa099e1781791509496
Questions about telegramph.188174.xyz
- Is telegramph.188174.xyz safe?
- No. MalwareAnalyzer scanned telegramph.188174.xyz on 21 Aug 2026 and returned a suspicious verdict with a score of 48 out of 100. Treat it as hostile until it is re-checked.
- How was telegramph.188174.xyz checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the standard tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of telegramph.188174.xyz
Scanned on MalwareAnalyzer by Cyble · Open interactive scan