# 0x6rss/matkap

Matkap - hunt down malicious Telegram bots

Repository: https://github.com/0x6rss/matkap
Canonical: https://ross.abutalabs.com/products/matkap
Language: JavaScript
License: MIT
License Family: permissive
Topics: osint, telegram, cti, intelligence, malware
Last push: 2026-08-25T21:46:01+00:00

## Health v2 (maintenance only)
Score: 65/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 35, longevity 39
- inputs: {"age_days": 557, "days_push": 8, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1008, forks 175 (observed 2026-08-28T04:03:11.636190+00:00)

## What it is
Matkap is a self-hosted web application for hunting malicious Telegram bots used as malware command-and-control infrastructure. It validates recovered bot tokens, forwards operator messages, discovers leaked tokens from threat-intel sources, monitors live bot update streams, and aggregates threat feeds and MalwareBazaar sample data.

## Use cases
- hunt malicious telegram bot c2 servers
- validate recovered telegram bot tokens
- find leaked telegram bot tokens in threat intel feeds
- monitor live telegram bot exfiltration traffic
- track malware samples using telegram bot api
- aggregate telegram c2 indicators from threat reports

## When to choose
- you are a threat intelligence analyst investigating Telegram-based malware C2
- you recovered a bot token from malware and need to observe operator activity
- you want to correlate MalwareBazaar, ThreatFox, and TweetFeed data on Telegram C2

## When to avoid
- you need general malware reverse engineering or sandbox analysis
- you lack authorization to investigate the bot tokens in question
- you need a passive IOC feed without active Telegram interaction

## Facets
- artifact type: application
- maturity: active
- function: osint, security, search-engine, analytics, chatbot
- domain: security, osint, messaging-platforms, developer-tools
- platform: self-hosted
- tags: threat-intelligence, telegram, malware-analysis, c2-hunting, cyber-threat-intel, ioc-discovery, malwarebazaar, threatfox, web-server, nodejs

## Member repositories
- 0x6rss/matkap (main) score 65

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:11.636190+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:12:05.900456+00:00, confidence not recorded.
  - readme: https://github.com/0x6rss/matkap (fetched 2026-08-28T04:03:11.636190+00:00, sha 488339cfe3bb)
- Data as of 2026-08-30T08:39:29.467469+00:00.