Coverage

What IntelMCP reads

A hand-picked collection of public Telegram channels and groups, chosen for threat-intelligence value rather than size. We list topics and regions here, not individual channels: every search result and match names the channel its message came from.

The collection in numbers

public channels and groups with collected history: 228
of them posted in the last 14 days: about 150
messages collected since 3 July 2026: 175,691
new messages a day, depending on events: 1,200–3,400

Figures as of 3 October 2026, from a read-only query of the production database. We update them by hand.

In words: as of 3 October 2026, IntelMCP holds 175,691 messages from 228 public channels and groups, collected since 3 July 2026. About 150 of those channels posted in the last 14 days; the rest post rarely or have gone quiet. The collection grows by roughly 1,200 to 3,400 messages a day, more when something big happens. Searches reach up to the last 90 days.

Where it is strongest

Gulf and the wider Middle East

The deepest part of the collection: regional hacktivist groups, defacement and DDoS claims, leak posts, and regional cyber news.

hacktivist claims
defacements
DDoS target lists
leak posts

Iran–Israel

Hacktivist and leak channels around the conflict, claiming intrusions, data leaks and disruption in Persian, Hebrew, Arabic and English.

intrusion claims
data leaks
infrastructure claims

Russia–Ukraine hacktivism

Hacktivist channels announcing targets and claiming attacks, mostly in Russian.

target announcements
DDoS claims
campaign chatter

Leaks, ransomware and CVEs

Leak and ransomware trackers that repost victim announcements, plus exploit chatter and CVE feeds from around the world.

ransomware victims
leak trackers
exploit claims
CVE feeds

Ask Claude to list source topics to see the topics the sources are tagged with, how many sources each has and how many posts a day they produce. Rules and searches can be narrowed to a topic.

Languages

العربيةar
فارسیfa
Русскийru
עבריתhe
Englishen

Posts are stored in their original language, and searches can be limited to one of them. Search matches whole words and, by default, parts of words too, which catches Arabic and Persian words with attached prefixes such as و, ال and ب. Word rules in Arabic and Hebrew also match spelling variants and attached prefixes. Country names are recognised in 18 languages, and from flag emojis and country-code domains (such as .sa or .ir), so a rule for a country catches it however it is written.

You don't need to read these languages. Claude turns your question into searches in the original languages and reads the results back to you in English, with a link to each post.

What each message carries

The text as posted. In its original language, with the date, the channel and a link to the post.
Edit history. Earlier versions when a post is edited, so you can see what it said first.
Forwards and copies. Where a forwarded post came from, and the earliest copy among the channels IntelMCP collects.
Indicators. IP addresses, domains, URLs, MD5, SHA-1 and SHA-256 hashes, CVE identifiers and countries, including defanged forms. A domain rule also catches subdomains and email addresses at the domain; addresses are matched in the text, never extracted.
Attachment details. The type, name and size of any file or image a post carried. Files are never downloaded.
Deletions honoured. When a post is deleted at the source, it is removed from IntelMCP once the collector sees the deletion.

Where it is thinner

Coverage of other regions and topics is thinner and uneven. The collection was built around the areas above, and a quiet week in one region can mean a gap in the collection rather than a quiet week on Telegram.

If a public channel you care about is missing, ask Claude to Request a channel with its @username or t.me link and, if you like, a reason. You can make up to 10 channel requests a month. Every request is reviewed by hand before a collection account joins the channel, so it is not added straight away, and some requests are declined. Private chats and invite-only groups are never added. If the channel is already collected, Claude says so, with its last post and the date its stored history starts, and no request is filed.

What IntelMCP does not cover

Private chats and invite-only groups. Never collected.
Other platforms. No forums, dark-web sites, X or Discord. Telegram only.
Stealer logs and credential databases. IntelMCP is not a breach-lookup service, and it does not extract email addresses or Telegram usernames of people in posts.
Takedowns. We don't contact channels or remove content from Telegram.
Verified intelligence. Posts are third-party claims, often false or exaggerated. IntelMCP gives you leads and the trail back to the source; you and Claude judge them.

Want to see whether it covers your area before paying? Email support@intelmcp.io with the region or sector, and we'll tell you what the collection holds for it.