How do I protect my Telegram group from dangerous links?

The problem

Telegram groups and channels are prime targets for phishing, especially in crypto, finance, and tech communities. Scam links disguised as token airdrops, fake exchange logins, and impersonated project websites flood group chats. Telegram's built-in link preview doesn't detect brand impersonation, freshly registered phishing domains, or suspicious redirect chains.

Group admins need automated protection that catches what Telegram misses. Without it, one clicked link can compromise wallets, credentials, or entire community trust.

How Unphurl solves it

Build a Telegram bot using the Telegram Bot API that monitors group messages for URLs. When a link is posted, the bot calls the Unphurl API, gets back a score and structured signals, and warns the group (or deletes the message) if the score exceeds your threshold. Brand impersonation, fresh domains, suspicious redirects, and IP-based URLs all get flagged before anyone clicks.

Signals that matter for this use case

– Brand impersonation catches fake exchange and project domains (Uniswap, Coinbase, MetaMask, etc.)
– Domain age <7 days flags infrastructure created in the last week, common in crypto scams
– Domain age <30 days catches recently staged phishing campaigns
– Excessive redirects detects obfuscated redirect chains hiding the real destination
– URL contains IP catches direct IP access, common in scam links
– Encoded hostname detects percent-encoded hostnames used to obfuscate malicious URLs

Suggested scoring profile

{
  "name": "telegram-bot",
  "weights": {
    "brand_impersonation": 40,
    "domain_age_7": 30,
    "domain_age_30": 20,
    "redirects_5": 25,
    "url_contains_ip": 15,
    "encoded_hostname": 10
  }
}

What a result looks like

A user posts a link claiming to be a token airdrop from Uniswap: https://un1swap-claim.xyz/airdrop. Your bot checks it:

Score: 82/100

Brand impersonation: uniswap.org (+40)

Domain age: 2 days (+25)

MX record: none (+5)

Phishing floor: applied (80 minimum)

The bot posts the signals to the group: "Score: 82/100. Brand impersonation detected (uniswap.org). Domain age: 2 days. No MX record." The group admin decides whether to remove the message.

Cost

Most links shared in Telegram groups are known domains (Google, YouTube, Twitter, legitimate project sites) that resolve free from the Tranco list. In a moderately active group, maybe 5-20 unknown URLs per day trigger pipeline checks. The Starter package (100 credits, $9) covers 1-3 weeks.

Get started

For developers

Build a Telegram bot using the Bot API (getUpdates or webhooks). Extract URLs from messages, call the Unphurl API, and reply or delete based on score.

# Check a URL from your Telegram bot
curl -s "https://api.unphurl.com/v1/check?url=https://un1swap-claim.xyz/airdrop&profile=telegram-bot" \
  -H "Authorization: Bearer $UNPHURL_API_KEY" | jq '.score'

For non-coders (Claude Cowork, OpenClaw, or any AI agent)

If you use Claude Cowork or OpenClaw with Telegram integration, ask your agent to check links in your Telegram messages. OpenClaw supports Telegram natively via its messaging integration.

Read the docs All use cases