Post cover image

July 19, 2026

Hunting Phishing Infrastructure on Netlify: Telegram Bot Exfiltration Across Multiple Lure Themes

Netlify’s free hosting tier has become a persistent favorite for phishing operators. Let’s break into Webamon Intel and see what’s inside.

By Nouman

6 min read

Background: Why Netlify and Telegram?

Netlify abuse for phishing is well-documented in recent industry reporting. More recently, Guardio Labs (May 2026) attributed the "AccountDumpling" campaign, which abused Netlify-hosted Facebook clones, to a Vietnamese threat actor, estimating roughly 30,000 compromised records exfiltrated exclusively via Telegram bots.

This research shows how Netlify and Telegram API infrastructure can be found via queries inside Webamon Intel.

Hunt Methodology

The entry point was a broad query to understand how much of the Netlify subdomain space Webamon had indexed:

domain_name:"netlify.app"

Result: ~38,653 scanned pages — a large surface to work with.

None

Browsing the results immediately showed a mix of benign sites alongside pages tagged phish_destroy and webamon_x. The tag distribution motivated a pivot: narrow to pages that contain outbound calls to api.telegram.org embedded in their DOM.

domain_name:"netlify.app" AND dom:"api.telegram.org"

Result: 120 unique scans across the April–May 2026 window.

None

The timeline reveals consistent daily activity between 5 and 15 scans per day, with peaks on April 13 and April 20. Three tags appear: webamon_x, phish_destroy, and openphish — confirming that multiple independent threat intelligence feeds converged on this infrastructure independently.

None

From here, pivoting by page_title allowed segmentation of the 120 results into distinct lure families.

Family 1 — Instagram Credential Harvester

domain_name:"netlify.app" AND dom:"api.telegram.org" AND page_title:"Instagram"

Count: ~20 scans · Unique domain: 1

Confirmed URL: https://singular-liger-f9a0bf[.]netlify[.]app/

None

Infrastructure fingerprint:

  • Scripts: 1 · Requests: 5 · Domains: 1
  • Campaign ASN: Amazon.com, Inc.
  • Resolved domain: netlify.app

The page presents a pixel-faithful Instagram profile clone for an account named 28mk_o'quvchilar (Uzbek: "28th school students"). Every interactive element — Follow, Like, and comment submission — is intercepted and triggers a camera permission request. If the user grants access, the front-facing camera captures a still image and transmits it silently to a hardcoded Telegram bot token alongside the interaction event. The camera prompt is framed as "Metavreficion authentication" (a fabricated Meta verification step) to reduce suspicion.

const botToken = '<REDACTED_TELEGRAM_BOT_TOKEN>';
const chatId   = '5775880996';
// canvas.toBlob → FormData → POST /sendPhoto
None

Notable TTPs:

  • Camera hijack on social interaction (Follow/Like/Comment)
  • Photo exfiltration via sendPhoto endpoint (not just sendMessage)
  • Fake Meta verification overlay to justify camera access
  • Targets Uzbek-language audience; content references school/year group context

Family 2 — Microsoft Verification Gate

domain_name:"netlify.app" AND dom:"api.telegram.org" AND page_title:"Microsoft Verification"

Count: ~21 scans · Unique domain: 1

Confirmed URL: http://moisecuros-strudel-d365-nougat-7c34b7[.]netlify[.]app/

None

Infrastructure fingerprint:

  • Scripts: 1 · Requests: 1 · Domains: 1
  • Campaign ASN: Wikimedia Foundation Inc. (favicon sourced from Wikipedia)
  • Resolved domain: wikimedia.org

A dark-themed page impersonating a Cloudflare-style browser check, branded with the Microsoft logo and displaying www.microsoftonline.com as the apparent origin. The user is presented with a press-and-hold button. Once held to 100%, the page extracts the visitor's IP address via api.ipify.org, decodes a base64-encoded email address from the URL hash parameter, records browser fingerprint data, and transmits the full package to a Telegram bot before redirecting to a secondary credential-harvesting stage hosted on DigitalOcean Spaces.

const token  = "<REDACTED_TELEGRAM_BOT_TOKEN>";
const chatId = "1875220952";
// message: IP + decoded email + visit time + page URL → sendMessage

Notable TTPs:

  • URL-encoded victim email in hash fragment — enables targeted, per-victim deployment
  • IP geolocation capture via ipify.org before exfiltration
  • Chainloads a DigitalOcean Spaces secondary stage (credential form)

Family 3 — Webmail Sign-in (Multi-Provider)

domain_name:"netlify.app" AND dom:"api.telegram.org" AND page_title:"Webmail Sign-in"

Count: ~60 scans · Unique domains: 3

Confirmed URLs:

None

Infrastructure fingerprint (per domain):

  • Scripts: 4 · Requests: 8 · Domains: 5
  • ASNs: Fastly · Amazon · Google · Cloudflare
  • External dependencies: jsdelivr.net · googleapis.com · gstatic.com · ipify.org

A fake CAPTCHA checkpoint ("I am not a robot") precedes a dynamic email/password form. The page reads the victim's email address from a ?eta= URL query parameter, pre-fills the email field, and dynamically adjusts the form's favicon, domain label, and background iframe to match the victim's actual email provider — creating a convincing session-expiry prompt.

The password is captured on first submission and sent to Telegram; the page then displays a "Try again" error to prompt a second entry before finally redirecting to the legitimate provider domain.

This double-submission pattern is a known technique for capturing typing errors and ensuring at least one valid credential is collected.

Three separate bot tokens / chat IDs were identified across the three domains:

marvelous-sfogliatella        <REDACTED>            5949616705
dynamic-yeot                  <REDACTED>            6449582180
wonderful-puppy               <REDACTED>            7137479566
None

The use of distinct bot tokens per deployment suggests either independent operators using the same kit, or a single operator partitioning victim traffic across separate Telegram channels for management or resale.

Notable TTPs:

  • ?eta= parameter pre-populates victim email — targeted deployment pattern
  • Dynamic provider branding via favicon and background iframe
  • Double-submit credential capture
  • CAPTCHA gate evasion technique used

Family 4 — Roblox Login Page

domain_name:"netlify.app" AND dom:"api.telegram.org" AND page_title:"Log in to Roblox"

Count: ~19 scans · Unique domain: 1

Confirmed URL: https://aquamarine-babka-45edc2[.]netlify[.]app/

None

Infrastructure fingerprint:

  • Scripts: 1 · Requests: 3 · Domains: 1
  • Campaign ASN: Amazon.com, Inc.
  • Resolved domain: netlify.app

A full Roblox login page clone with a functional-looking navigation bar, search field, and Sign Up button. On credential submission the page displays a fake ERROR 653 THE SERVER NOT RESPONDING message to create urgency, transmits the username, password, IP address, User-Agent, platform string, and page URL to a Telegram bot, then redirects to the legitimate roblox.com/home.

const BOT_TOKEN = "<REDACTED_TELEGRAM_BOT_TOKEN>";
const CHAT_ID   = "7166904036";
// message: username + password + IP + UA + platform + URL → sendMessage (Markdown)

Notable TTPs:

  • Gaming platform lure — likely targeting younger users or account traders
  • Fake server error to explain away the login failure
  • Full browser fingerprint collected alongside credentials
  • Redirect to legitimate platform post-capture to suppress suspicion

Cross-Campaign Infrastructure Observations

Despite the four distinct lure themes, several shared patterns emerge across the full 120-scan dataset:

Shared exfiltration architecture: Every kit embeds Telegram bot tokens and chat IDs in plaintext JavaScript. All use api.ipify.org for IP harvesting prior to exfiltration. This pattern is consistent across operators and is characteristic of commodity phishing kit reuse rather than bespoke development.

Netlify subdomain naming: Random adjective-noun-hexstring patterns (singular-liger-f9a0bf, aquamarine-babka-45edc2, marvelous-sfogliatella-f320f8) are auto-generated by Netlify's deployment pipeline when no custom name is specified. This is a reliable indicator of automated or script-driven deployment.

Tag convergence: The presence of both phish_destroy and webamon_x tags on the same scans indicates that these pages were independently identified by at least two threat intelligence feeds simultaneously — confirming active, live phishing rather than historical infrastructure.

Campaign window: The timeline shows a concentrated 21-day activity window (April 5–25, 2026), suggesting either a burst deployment campaign or a period when new Netlify subdomains were being generated faster than takedowns could occur.

Additional Pivot Queries for Further Investigation

# Expand to other free-tier hosting with same exfiltration pattern
dom:"api.telegram.org" AND (domain_name:"vercel.app" OR domain_name:"pages.dev")
# Hunt by ipify dependency (common across all four families)
dom:"api.ipify.org" AND dom:"api.telegram.org" AND tag:phish_destroy
# Hunt Microsoft lure variant by DigitalOcean redirect destination
dom:"digitaloceanspaces.com" AND dom:"api.telegram.org"
# Cluster by shared Webmail kit fingerprint (4 scripts, 8 requests, 5 domains)
meta.script_count:4 AND meta.request_count:8 AND meta.domain_count:5 AND dom:"api.telegram.org"

Conclusion

The combination of Netlify's free hosting and Telegram's Bot API represents a low-cost, high-volume phishing pipeline that is actively exploited across multiple lure themes simultaneously. The 120-page cluster identified here spans gaming, social media, enterprise authentication, and webmail — indicating either a single versatile operator or a shared commodity kit distributed across multiple actors.

The dom:"api.telegram.org" field in Webamon provides a direct behavioral signal that cuts across all surface-level lure variation. Combined with domain_name scoping to a specific hosting provider, it produces an actionable, low-noise query that surfaces active infrastructure at scale.

Bot tokens identified in this research have been noted for potential takedown action.

Defenders are encouraged to block or alert on outbound requests to api.telegram.org from browser contexts on managed endpoints, and to treat *.netlify.app URLs with unknown reputation as requiring dynamic content inspection rather than static URL-reputation lookup.

Indicators of Compromise (IOCs)

Malicious Domains

  • singular-liger-f9a0bf[.]netlify[.]app
  • moisecuros-strudel-d365-nougat-7c34b7[.]netlify[.]app
  • marvelous-sfogliatella-f320f8[.]netlify[.]app
  • dynamic-yeot-cfe7fa[.]netlify[.]app
  • 6981f042ccad4d00a690b068--wonderful-puppy-834e9a[.]netlify[.]app
  • aquamarine-babka-45edc2[.]netlify[.]app

Telegram Chat IDs

  • 5775880996
  • 1875220952
  • 5949616705
  • 6449582180
  • 7137479566
  • 7166904036

Secondary Infrastructure

  • driveacess8973a98bc763hjyut86yw89te4e3.atl1.cdn.digitaloceanspaces.com
  • api.ipify.org (victim IP harvesting, present in all families)
  • api.telegram.org (exfiltration endpoint, common to all 120 pages)

Telegram Bot Tokens

  • 7821489849:AAGAeYJ09QL7s8MJ2cbnAJclyLOXkBmuUys
  • 7044201044:AAHwEuzn6v8oGMKy73K4555jqHVuLN8AQnU
  • 8142788522:AAEtTzXqV-8wwXTKHuPFCy-PuYZertf900c
  • 8339609140:AAHOwcTS-yKiHJYY5Ef3XSuMHGcvh4dgFyM
  • 8147879989:AAEsN92VAlVT5OF1XJ9HxES0kARzrXq4SOY
  • 8575079756:AAGHr0G43VejMqQcAH74bmXIT15N6RNUR-U

Note: I have moved my research blog from webamon.com to my personal medium blog and asked them to remove from there site as I am not working as Comunity Threat Researcher anymore.