hxxps://api.telegram[.]org/botURL
Reported by 2 independent sources · first reported by Group-IB · last reported
Last reported 3 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Targeted Attack on Government Entities in the Middle East | Part 1“In the next phase, TELESHIM enters a polling loop by sending HTTP GET requests to the following URL to fetch updates: hxxps://api.telegram[.]org/bot[BOT_TOKEN]/getUpdates?offset=[N].”
-
ShadowSilk: A Cross-Border Binary Union for Data Exfiltration“$URL="hxxps://api.telegram[.]org/bot{0}" -f $Token”
-
Trust Hijacked: The Subtle Art of Phishing Through Familiar Facades“After the victim submits their credentials, the phishing page initiates a POST request to hxxps://api.telegram[.]org/bot<token>/sendMessage.”
Indicators reported together
named in the same reports- 7a14a99d70d42d3f7bf72f843185fc07in 1 report
- cert.hypersnet[.]comin 1 report
- ssl.blsouqs[.]comin 1 report
- contacts.ftabnews[.]comin 1 report
- 577b1cc894636f4a…b9b7ade137c3in 1 report
- 3b0c658ebaa2bae8…e84da4fa669din 1 report
- message.chat[.]idin 1 report
- c99f29ac08454855b3d538960bb2f34fin 1 report
- 97124a93766be732e8fef5a56a5346a2in 1 report
- c1f16e31ae71372e…c7b887a4e3f2in 1 report
- 789fd11285642861…c907f7f320bdin 1 report
- 68926e6c958562deaae35de3d9f59de3in 1 report
- ccb2002fe8f5cc1f…b52d1c507421in 1 report
- c84542ac30cbe9bb…2466e084340fin 1 report
- 087499849115eb28c4364581d2b28d09in 1 report
- 86ee99f293a30720…91f93fb9be95in 1 report
- 32529043d15e9111…02feacd44e66in 1 report
- b776eb638fbb535708fb92b12fcc1731in 1 report
- 2377c47cfde148c2…8174f9c4d56din 1 report
- db11ff3f37a8b2aa…45f6bbf9582bin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.