Telegram Bot Token

Description

General

• Documentation: https://core.telegram.org/bots/api#authorizing-your-bot
• Summary: Telegram is a messaging app. This detectors aims at catching tokens used by bots to authenticate requests.
• IPs allowlist: This feature is not available.
• Scopes: There is only one token per bot and it is not possible to customize its permissions.

Revoke the secret

The secret can be revoked by sending a message "/revoke" to @BotFather on Telegram as stated in this StackOverFlow thread.

Check for suspicious activity

This feature is not described in the documentation.

Details for Telegram Bot Token

• Family: token

• Category: messaging_system

• Company: Telegram

• High recall: True

• Validity check available: True

• Analyzer available: False

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Minimum number of matches: 1

• Occurrences found for one million commits: 522.84

• Prefixed: True

• PreValidators:

- type: ContentWhitelistPreValidator
  patterns:
    - :aa
- type: ContentWhitelistPreValidator
  patterns:
    - '[0-9]{9,12}:aa'

Examples

- text: "const BOT_TOKEN = '508627689:AAEuLPKs-EhrjrYGnz60bnYNZqakf6HJxc0';"
  apikey: 508627689:AAEuLPKs-EhrjrYGnz60bnYNZqakf6HJxc0
- text: 'https://api.telegram.org/bot537236252:AAG5OA3tkCvKRuBCj0EJ3VGs4V56QgixbZc'
  apikey: 537236252:AAG5OA3tkCvKRuBCj0EJ3VGs4V56QgixbZc
- text: "TOKEN = '1628091811:AAG9RuJiqgOGIfFbOPBpAo6QhIJoD9mCdDs'"
  apikey: 1628091811:AAG9RuJiqgOGIfFbOPBpAo6QhIJoD9mCdDs