Telegram RegisterThe public register of Telegram

Channel

Cyber Guardians

@IRCyberGuardians

On this record: Topic · Observations · Also posting the same content · Growth · Engagement · What this channel posts · Posts · Citations · Telegram's recommendations · Cite this entry

18,832subscribers

+146 since we began measuring on 7 August 2026

Risers and fallers across the register · movement among entries of 10,000–31,623.

Register entry

Telegram ID-1001944628180
TypeChannel
Username@IRCyberGuardians
DescriptionRedTeaming TTPs Bug Hunting Web PenTest Web Security Binary Analysis Exploit DEV Malware DEV Malware Analysis BlueTeaming Threat Hunting SOC CSIRT FORENSICS Open-Source Intelligence(OSINT) Cybersec Tools
CreatedBetween 1 March 2023 and 31 October 2023— estimated from Telegram’s id allocation, not measured. How this range is calculated.
First recorded7 August 2026
Last confirmed live12 August 2026
Measurements held8
Confirmed unchanged1 time, most recently 12 August 2026
On Telegramt.me/IRCyberGuardians

Topic

Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-UD-Q6_K_XL, prompt version 1) read this channel’s own recent posts on 10 August 2026 and assigned it the closest of 31 fixed categories, at 100% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and why it has no browse page of its own yet.

Observations

These are measurements, not verdicts. Each one below states something we counted, alongside the evidence it was counted from, so you can check it rather than take it. None of them is graded: every observation this register holds is recorded at severity 0, because the precision of the detectors behind them has not been measured yet, and a rating we cannot support is worse than none. Read each as a fact about the data, not as a judgement about the channel. How we measure.

Content that also appears on other registered channels

Posts published here appear word for word on 1 other registered channel. They sit inside a group of 3 channels that share the same post bodies with each other. The matching is on the text itself, not on Telegram’s forward marker, so it finds a copy whether or not it was labelled as one.

Matching posts — open both and compare (5 of the pairs behind the counts below)
Posted firstThenOverlapGap
@P0x3k_1N73LL1G3NC3/39115 Jul 2026, 15:26 UTC@IRCyberGuardians/3927 · this entry3 Aug 2026, 14:30 UTC0.9919 days
@P0x3k_1N73LL1G3NC3/39729 Jul 2026, 04:26 UTC@IRCyberGuardians/3932 · this entry4 Aug 2026, 14:31 UTC0.986 days
@P0x3k_1N73LL1G3NC3/39831 Jul 2026, 18:08 UTC@IRCyberGuardians/3933 · this entry4 Aug 2026, 14:31 UTC0.984 days
@P0x3k_1N73LL1G3NC3/39318 Jul 2026, 17:48 UTC@IRCyberGuardians/3929 · this entry3 Aug 2026, 14:30 UTC0.9816 days
@P0x3k_1N73LL1G3NC3/39420 Jul 2026, 20:49 UTC@IRCyberGuardians/3930 · this entry3 Aug 2026, 14:30 UTC0.8914 days
Every channel this entry shares post bodies with
ChannelMatching postsText overlapTypical gapPublished first
@P0x3k_1N73LL1G3NC35 (5/5 hand-verifiable sample passed)0.9614 days@P0x3k_1N73LL1G3NC3 (50)

Text overlap is the Jaccard coefficient over the set of distinct three-word phrases in the two bodies: 1.00 is identical wording, and the threshold for counting a pair at all is 0.70. Candidates are generated by simhash LSH (4 x 16-bit bands, exact Hamming <= 3) verified against the bodies with Jaccard over the SET of distinct 3-word shingles. Published first counts which side of each matching pair carries the earlier timestamp — in this corpus, which is the limitation directly below.

What this cannot establish

MEASURED, DOMINANT ERROR SOURCE: a post ingested before 2026-08-06 may have carried a forward header that was not recorded. A 45-pair hand-check against live t.me pages found 14 (31%) where the live page shows a forward header naming the other channel and the database has none, plus 4 more (9%) naming a third party. The text match itself was wrong 0 times out of 45. Read attribution_capture.items_in_trusted_window before treating the unattributed count as a claim.

Telegram lets a channel forward a post with a header naming the source, and we only began reliably recording that header on 2026-08-06. None of the 5 matches recorded here fall after that date, so for this entry we cannot say whether any of them carried a credit. The duplication is measured; the absence of attribution is not.

“Published first” means first in this corpus. We hold 21 comparable posts for this entry, running 3 August 2026 to 7 August 2026. A channel we have read one page deep will look younger than a neighbour we have read in full, and the order would flip with no change in the underlying facts.

The detector’s own notes on this observation, as it recorded them. Names in this_style are fields of the underlying evidence record, which the plain-English paragraphs above read out for this entry.

  • Verbatim republication has three causes and the text separates only two: a clone/mirror, unattributed copy-paste, or BOTH channels copying a common third source that neither attributes. The spread filter (content held by at most 8 channels) reduces the third and does not remove it.
  • 'Earliest' means earliest IN THIS CORPUS. A channel ingested one page deep will look younger than a neighbour ingested in full; corpus_coverage above is there to be checked before the direction is believed.
  • shared_verified_est extrapolates the sampled pass rate over the full narrow match count; sampled/passed are the numbers actually measured.
  • Absence of a forward header is not proof of intent: Telegram lets a channel disable forward attribution, and a credit written in the body is not parsed as attribution here (mention_edge_either_way above is the closest available signal).

Across the whole group of 3, the earliest publisher we hold is @APT_Notes. That is a statement about our reading window, not a claim of authorship.

Recorded under the key clone_copy, last confirmed 7 August 2026. An observation that a later pass no longer finds is cleared, and a cleared observation is removed from this page rather than being shown struck through — we do not keep publishing a claim we have withdrawn. Dispute an observation.

Also posting the same content

This channel’s posts match, word for word or near enough, posts on 2 other registered channels, found by comparing text fingerprints across every channel on the register. That matching has been checked by hand against the live Telegram pages and found reliable — 0 wrong of 45 pairs re-read.

Which channel, if either, published first is deliberately not shown. The same hand-check found that reading wrong 18 of 45 times — 60%, no better than a coin flip — because it depends on how deep our own crawl happened to reach into each channel’s history, not on when the content was actually first posted. This list is ordered by subscriber count, the same as every other listing on this site, never by which channel we think came first. Word-for-word matching has several ordinary explanations besides copying — a channel mirroring itself, an unattributed repost, or two channels independently repeating the same wire story — and this measurement cannot tell those apart. How this is measured.

Growth

18,68618,83218,7597 August 2026 — 18,686 subscribers7 August 2026 — 18,686 subscribers7 August 2026 — 18,690 subscribers8 August 2026 — 18,726 subscribers9 August 2026 — 18,756 subscribers10 August 2026 — 18,769 subscribers11 August 2026 — 18,801 subscribers12 August 2026 — 18,832 subscribers7 August 202612 August 2026
8 measurements spanning 5 days, net +146. Dots are measurements; the straight line between them is drawn to join them, not to claim we know the path taken in between — snapshots are recorded only when a count changes, so gaps mean “no change observed”, never “interpolated”. The vertical axis spans 18,664–18,854 and does not start at zero.
Measurement log — every subscribers count we have recorded
Measured (UTC)SubscribersChange
12 Aug 2026, 19:5618,832+31
11 Aug 2026, 20:1218,801+32
10 Aug 2026, 20:0318,769+13
9 Aug 2026, 22:1218,756+30
8 Aug 2026, 19:3418,726+36
7 Aug 2026, 18:1018,690+4
7 Aug 2026, 11:3018,686no change
7 Aug 2026, 11:1918,686first reading

Engagement

26 posts held, back to 3 August 2026the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 16 pagesof Telegram’s post history, 20 posts per page.

ERR · 30 days
3.96%
avg views ÷ 18,832 subscribers
Avg views / post
745
26 posts measured
Reaction rate
this channel exposes no reaction counts
Posts in window
26
of 26 held

ERR is average views per post over the last 30 days divided by subscribers, the definition TGStat uses, so this figure is comparable with the one you will see elsewhere. It falls structurally as a channel grows: a high ERR on a small channel and a low one on a large channel describe reach mathematics, not quality. We publish the figure and the sample it came from and pass no verdict on it.

ER is defined industry-wide as (forwards + reactions + comments) ÷ views— note the denominator is views, not subscribers. Telegram’s public web preview carries views and reactions but not forward or comment counts, so the reaction rate above is the reactions term only and is therefore a floor: the true ER for this channel is higher by an amount we have not measured and will not estimate.

What these figures were computed from
WindowRolling 30 days · latest post in window 12 August 2026
Posts held26 (3 August 202612 August 2026)
Views total19,366
Reactions total
Forwards / commentsnot exposed by the public surface — not measured, not estimated
Readings taken12 Aug 2026, 23:59 UTC

Views are a single reading per post, taken at the time above. A post published in the last day or two is still accumulating views, which pulls the 30-day average down slightly. That is a property of the standard definition rather than a fault in it, so we keep the definition rather than “correcting” the number into something nobody can reproduce.

Precision. Telegram publishes view counts on its public widget in short form — 8.12K, 3.7M — so any reading at or above 1,000 reaches us rounded to three significant figures, and only counts below 1,000 are exact. Averages and rates derived from them are shown to the same precision rather than to the unit: a figure like 3,701,250 would assert digits nobody measured.

Reaction counts are published per emoji and rounded the same way, so a total below 1,000 is exact and a larger one is a sum that may carry a rounded component from each emoji above 1,000. Because it is a sum, it does not look rounded — read a large reaction total as three significant figures per contributing emoji rather than as the figure it prints.

What this channel posts

Photos
111
Videos
5
Links
3,710

Lifetime counters from Telegram’s own channel header, read 12 August 2026 — not the date at the top of this page, which is when the subscriber count was last read. A count marked was rounded by Telegram before we ever saw it — t.me prints these counters in full below 1,000 and to three significant figures above, so ≈142,000 means somewhere between 141,500 and 142,499.

Recent posts

12 Aug 2026, 17:47 UTC298 viewsread 12 August 2026

Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline. Blog: https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authe

7 Aug 2026, 14:31 UTC≈1,490 viewsread 12 August 2026

Exploiting HTTP Parser Inconsistencies: ACL Bypasses, SSRF, and Cache Poisoning Original text: “Exploiting HTTP Parsers Inconsistencies” — Rafa, Rafa’s Security Researches (research conducted December 2021 – April 2022). Code blocks, tables and figures below are reproduced verbatim with attribution captions. Executive Summary HTTP is the connective tissue of the modern web, but the specification leaves enough ambi

7 Aug 2026, 14:31 UTC≈1,120 viewsread 12 August 2026

Dnsmasq DNS Remote Heap Buffer Overflow (CVE-2026-2291) Original text: “Dnsmasq DNS Remote Heap Buffer Overflow” — David Barksdale, Exodus Intelligence (July 20, 2026). Code snippets, DNS responses, and exploitation details are reproduced verbatim with attribution. Executive Summary CVE-2026-2291 is a critical remote code execution vulnerability in dnsmasq, a widely deployed lightweight DNS and DHCP server used in

7 Aug 2026, 14:31 UTC803 viewsread 12 August 2026

KernelCallbackTable Process Injection Original text: “KernelCallbackTable Process Injection” — S12, Medium (2026). Code blocks and technical implementation details are reproduced verbatim with attribution. Executive Summary Windows message handling is everywhere. Every GUI application sits in a message loop waiting for user input and window events. But what happens when an attacker corrupts the callback table that

7 Aug 2026, 14:31 UTC596 viewsread 12 August 2026

GDID: The Windows Global Device Identifier Original text: “GDID: The Windows Global Device Identifier” — Smukx, ZeroTrace Lab (July 18, 2026). Code blocks, commands, tables, and technical specifications reproduced verbatim with attribution. Executive Summary Every Windows installation receives a unique 64-bit Global Device Identifier (GDID) that serves as Microsoft’s canonical device-level tracking mechanism. The

7 Aug 2026, 14:31 UTC609 viewsread 12 August 2026

CVE-2026-49176 Exploit Development: WalletService to SYSTEM Original text: “CVE-2026-49176 Exploit Development: WalletService to SYSTEM” — David Carliez, 17 July 2026. Code blocks, tables, and technical diagrams are reproduced verbatim with attribution. Executive Summary CVE-2026-49176 represents a critical local privilege-escalation vulnerability affecting Windows WalletService, a LocalSystem-hosted service that

6 Aug 2026, 14:30 UTC861 viewsread 12 August 2026

[QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India) Original text: “[QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India)” — AI, 0day in {REA_TEAM} (July 13, 2026). Code blocks, tables, diagrams, and technical artefacts are reproduced verbatim with attribution captions. Executive Summary SolidPDFCreator.dll is a sophisticated stage-1 backdoor loader disguised as a legi

6 Aug 2026, 14:30 UTC747 viewsread 12 August 2026

CVE-2026-58629: A Double-Free in dxgkrnl’s CreateAllocation Rollback Original text: “July 2026 Patch Tuesday [CVE-2026-58629] Freeing the Wrong Allocation: a double-free in dxgkrnl’s CreateAllocation rollback” — gengstah, gengstah (personal blog), July 14, 2026. Disassembly, crash dumps and code below are reproduced verbatim with attribution captions. Executive Summary CVE-2026-58629 is a local elevation-of-privil

6 Aug 2026, 14:30 UTC566 viewsread 12 August 2026

CVE-2026-58532: An Integer Overflow in Windows tcpip.sys Original text: “How I found an integer overflow in tcpip.sys (CVE-2026-58532)” — April Ivy (aprilpet), April Ivy’s Writing (aprl.pet), 17 July 2026. The prose below is a paraphrase; the call stack, code snippets and proof-of-concept are reproduced verbatim with attribution. Executive Summary Security researcher April Ivy discovered an unsigned 64-bit integer

6 Aug 2026, 14:30 UTC547 viewsread 12 August 2026

Direct $MFT Parsing: Reading NTFS Below the Monitored API Layer Original text: “Direct $MFT Parsing” — S12 — 0x12Dark Development, on Medium. This article summarises the technique in our own words for readers of core-jmp.org; the ASCII pipeline diagram and the short C++ excerpts below are reproduced with attribution to illustrate the discussion. For the complete C++17 header, main runner, and YARA rule, follow the…

6 Aug 2026, 14:30 UTC568 viewsread 12 August 2026

CVE-2026-50343 InstallService StaticPluginMap EoP (Standard User to SYSTEM) Exploit + WriteUP @IRCyberGuardians

5 Aug 2026, 14:30 UTC795 viewsread 12 August 2026

The QNAP Pattern: Four Bugs and the Architecture That Keeps Producing Them Original text: “The QNAP Pattern” — Runic Labs (May 17, 2026). Code and architecture diagrams below are reproduced with attribution. Executive Summary Runic Labs disassembled a full disclosure cycle against QNAP’s QTS operating system—four bugs across three App Center plugins (Notes Station 3, QmailAgent, QVPN) spanning two firmware release

Showing the 12 most recent of 26 posts we hold for @IRCyberGuardians. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.

Citation-graph rank

Citation-graph rank — 903,333 of 1,151,006entries in the measured graph. A weighted position computed from the forward and mention edges below — republished posts weigh more than named mentions — and recomputed periodically, over the whole graph. Published only as this ordinal position, never as a score: a position is a fact, and a score printed beside one channel’s name would read as a verdict this register does not make. The two counts beneath stay separate for the same reason mentions are never summed with forwards anywhere else on this page — a named-by count costs nothing to manufacture. The top 100 by this measure, or how it is computed.

Forward network

Republished by

Channels on the register that have forwarded this channel's posts into their own feed.

Built only from forwarded posts we have actually read, on both sides. Coverage is early and deliberately incomplete: a missing link means we have not read the post that would prove it, never that the relationship does not exist. Counts are distinct forwarded posts observed, so they only ever go up as we read more.

Mentions

Named by 1 registered channel — every channel on the register whose own posts have named this one, by its current username or any other username it currently holds, merged from two separately captured readings of the same fact so a namer caught by only one of them is not missed and a namer both caught is not counted twice. A username this channel has since dropped is not matched — that handle may belong to someone else now, and crediting today’s namer to yesterday’s owner would misattribute it.

Named by

Channels on the register whose posts name this channel's handle.

A mention is a weaker signal than a forward and is counted separately for that reason — naming a channel is not republishing it, and a handle in a post body is easy to place deliberately. The post counts beside each row below are distinct posts in which the handle appeared, from posts we have read on both sides — the “Named by N registered channels” figure above is a different count, of distinct NAMING CHANNELS rather than posts, and is not the sum of the rows under it.

Appears in Telegram’s recommendations for other channels

The reverse of the list above, and a different kind of signal. This does not require this channel to have ever been asked about directly — each row below is a channel we DID ask Telegram about, whose Telegram-generated list happened to include this one. A channel can appear here with an empty list above it, because being named by someone else’s query is independent of having been queried itself.

Tricky Man
@Trickyman2 · 155,348
Telegram ranks this channel #51 of 57 here — alongside 56 others — read 12 August 2026

This channel appears in 1 seed channel's Telegram-generated recommendation list in total. Each is Telegram’s list for THAT channel, not this one — see how this is measured.

Cite this entry

A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 12 August 2026 — this entry's latest reading, not the date you are reading this.

“Cyber Guardians” (@IRCyberGuardians), 18,832 subscribers as measured 12 August 2026. Telegram Register, tgregister.com/channel/IRCyberGuardians.

Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.