Outbound HTTP/TLS traffic to Telegram Bot API (api.telegram.org)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects network traffic (HTTP, TLS, and DNS) originating from the internal network directed toward Telegram's API endpoints (api.telegram.org) and domains (t.me). This behavior is often associated with the use of the Telegram Bot API as a command-and-control (C2) channel or for data exfiltration by malware.