Loading threat actor…
MasRep is a Telegram-focused account takedown service identified through a cluster of bots sharing common webhook infrastructure. The operation appears to center on abuse of Telegram bots to facilitate account-reporting or takedown activity, and it was exposed through analysis of shared webhook relationships across at least 15 bots. The service used obfuscated branding with homoglyphs to disguise Cyrillic text and relied on infrastructure fronted by DDoS protection services. MasRep advertised a low-barrier onboarding model in which users were offered several free attacks in exchange for attaching a Telegram bot, enabling recovery and reuse of the bot token. This indicates an operational model built around bot acquisition and centralized control of Telegram-based automation rather than conventional malware deployment. High-confidence reporting ties MasRep to shared webhook infrastructure on the dyxless.im domain. The available evidence supports characterization as a Telegram abuse service involved in spoofing and operational misuse of bot infrastructure; broader attribution, victimology, and geographic targeting are not currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.