URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

Host:	api.telegram.org
Domain registrar:	GoDaddy
Domain registration date:	2003-12-15 14:48:05 UTC
Abuse complaint sent?:	Yes (2025-03-07 17:55:01 UTC to ops{at}pir[dot]org)
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Not blocked
Control D HaGeZi :	Not blocked
Firstseen:	2022-01-27 08:33:03 UTC
Total malware sites :	8
Online malware sites :	0 (0%)
Offline Malware sites :	8 (100%)
A record(s) observed :	1

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2022-01-27 08:33:09	149.154.167.220		SBL554015	AS62041 Telegram	GB	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2025-03-07 17:51:05	https://api.telegram.org/file/bot7446828960:AAE...	Offline	donutloader	aachum
2024-02-05 07:32:14	https://api.telegram.org/bot6775303908:AAHd23oi...	Offline	htlfeb24 stealer	JAMESWT_MHT
2024-01-06 12:56:04	https://api.telegram.org/bot6796626947:AAGohe-I...	Offline	AgentTesla bio0king RedLineStealer	JAMESWT_MHT
2023-12-13 04:01:05	https://api.telegram.org/bot6407936943:AAEbwVgC...	Offline	nigalulli	JAMESWT_MHT
2023-12-01 05:50:06	https://api.telegram.org/bot6668004993:AAHeLIV9...	Offline	bookingpdf stealer	JAMESWT_MHT
2023-11-17 13:19:05	https://api.telegram.org/bot6783627161:AAGQokZa...	Offline	bo0king-blogspot-com stealer	JAMESWT_MHT
2022-04-11 18:11:03	https://api.telegram.org/bot5273807869:AAHdhflf...	Offline	SnakeKeylogger telegram	JAMESWT_MHT

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2025-03-07 17:51:05	2fe9a15186a8df77788fec0f6c8e5c52f99686b9f84e1ff139b8ff052308bffa	unknown