telega.info

URL: https://api.telega.info/v1/dc-proxy

User Assessment: Dangerous

AI Verdict: SAFE (70% confidence)

Analysis: The URL returns a standard JSON response, which is typical for API endpoints and does not indicate a malicious web page or phishing attempt.

Key Findings:

• The URL serves a JSON data response rather than a web page.
• No login forms, download prompts, or deceptive content were detected.
• The domain has been active for over a year with no signs of malicious activity.

User Comment: Telega is an alternative Telegram client promoted in Russia and closely associated with VK LLC. Since March 18, Telega carries out a MITM attack on its users. The client requests (via Telega API) a list of IPs of Telega DCs in order to replaces the IPs of legitimate Telegram DCs with them. This provides the attacker with a complete users' Telegram account access.