Listen to this Post
In an era where cyber threats evolve faster than most defence teams can adapt, the ability to perform rapid threat intelligence lookups, indicator of compromise (IOC) checks, and contextual analysis from anywhere is no longer a luxury – it is a necessity. Traditional security operations centre (SOC) workflows are tethered to bulky workstations and proprietary software, but a new paradigm is emerging: the SOC analyst’s toolkit can now fit in a pocket. By combining the VirusTotal API, a large language model (LLM) via OpenRouter, and the Telegram messaging platform, it is possible to build a fully functional cybersecurity assistant bot that runs entirely from a mobile device. This article dissects the architecture, implementation, and practical deployment of such a bot, providing a step‑by‑step guide for security professionals, penetration testers, and blue‑teamers who want to mobilise their threat‑hunting capabilities.
Learning Objectives
- Understand how to integrate the VirusTotal API v3 for real‑time file and URL scanning within a Python‑based Telegram bot.
- Learn to incorporate an LLM via OpenRouter’s unified API to provide natural‑language threat analysis and contextual recommendations.
- Master the deployment and maintenance of a Telegram bot on Replit, including environment secret management and cost‑effective hosting strategies.
- Acquire practical coding patterns for building a mobile‑first cybersecurity assistant that supports SOC workflows, pentesting reference, and IOC validation.
1. Architecture Overview: The Triad of Threat Intelligence
The assistant bot is built upon three core pillars: a messaging interface (Telegram Bot API), a threat intelligence engine (VirusTotal API), and an AI reasoning layer (OpenRouter LLM). Telegram provides the user‑friendly chat interface, allowing analysts to send files, URLs, or textual queries from any device. The VirusTotal API acts as the primary threat‑detection engine, scanning submitted files against 70+ antivirus engines and multiple dynamic analysis sandboxes. The OpenRouter integration supplies a reasoning layer that interprets VirusTotal results, explains findings in plain language, and suggests remediation steps – effectively acting as a junior SOC analyst on demand. All components are orchestrated by a Python script hosted on Replit, which handles incoming Telegram messages, dispatches API calls, and formats responses.
2. Setting Up the Telegram Bot Foundation
Before writing any code, you must obtain a bot token from Telegram’s BotFather. Open a chat with @BotFather, send /newbot, choose a name and username, and copy the provided API token. This token authenticates your bot with Telegram’s servers. On Replit, create a new Python repl and store the token as a secret environment variable named `BOT_TOKEN` to keep it out of your source code. Install the required Python package: pip install python-telegram-bot==20.3. A minimal bot that echoes messages can be written as:
import os
from telegram import Update
from telegram.ext import Application, CommandHandler, MessageHandler, filters
TOKEN = os.getenv("BOT_TOKEN")
async def start(update: Update, context):
await update.message.reply_text("🔐 SOC Assistant Bot ready.")
def main():
app = Application.builder().token(TOKEN).build()
app.add_handler(CommandHandler("start", start))
app.run_polling()
if <strong>name</strong> == "<strong>main</strong>":
main()
Run this script on Replit to confirm your bot responds to /start. The polling method keeps the bot active, but for 24/7 operation you may need a keep‑alive mechanism (e.g., a Flask web server pinging the bot periodically).
- Integrating VirusTotal API for File and URL Scanning
VirusTotal’s API v3 is RESTful and returns JSON responses. The free tier limits requests to 4 per minute, so implement queuing or caching to avoid rate‑limiting errors. Obtain your VirusTotal API key from your profile page and store it as VT_API_KEY.
Scanning a File by Hash (No Upload)
To check if a file is already known, compute its SHA‑256 hash and query:
import requests
import hashlib
def check_file_hash(file_path):
sha256_hash = hashlib.sha256()
with open(file_path, "rb") as f:
for byte_block in iter(lambda: f.read(4096), b""):
sha256_hash.update(byte_block)
file_hash = sha256_hash.hexdigest()
url = f"https://www.virustotal.com/api/v3/files/{file_hash}"
headers = {"x-apikey": os.getenv("VT_API_KEY")}
response = requests.get(url, headers=headers)
return response.json()
This approach avoids uploading the file if VirusTotal already has a report. For new or unknown files, use the `/files` endpoint to upload (max 32MB).
Scanning a URL
Submit a URL for scanning using:
def scan_url(url):
endpoint = "https://www.virustotal.com/api/v3/urls"
headers = {"x-apikey": os.getenv("VT_API_KEY")}
data = {"url": url}
response = requests.post(endpoint, headers=headers, data=data)
return response.json()
The response includes a `scan_id` that you can later poll for results. In the Telegram bot, you can handle file uploads via the `MessageHandler` with `filters.Document.ALL` and URLs via a command like /scanurl.
4. Adding an LLM Reasoning Layer with OpenRouter
OpenRouter provides a single API key to access hundreds of models from providers like OpenAI, Anthropic, Google, and Meta. This unification simplifies the bot’s code – you only need one endpoint. Get your API key from openrouter.ai/keys and store it as OPENROUTER_API_KEY. The Python SDK (or a simple `requests` call) can be used to send chat completions:
import requests
def ask_llm(prompt):
response = requests.post(
url="https://openrouter.ai/api/v1/chat/completions",
headers={
"Authorization": f"Bearer {os.getenv('OPENROUTER_API_KEY')}",
"Content-Type": "application/json"
},
json={
"model": "openai/gpt-4o", or any supported model
"messages": [{"role": "user", "content": prompt}]
}
)
return response.json()["choices"][bash]["message"]["content"]
For SOC use, you can feed the VirusTotal JSON response into the LLM and ask: “Interpret these VirusTotal results. Summarise the threat level, highlight any notable detections, and suggest next steps for an incident responder.” The LLM will produce a human‑readable advisory that can be sent back to the Telegram user.
5. Building the Bot’s Command Set and Workflow
Design a set of intuitive commands that cover common SOC and pentesting tasks:
– `/scanfile` – Upload a file; the bot computes its hash, queries VirusTotal, and if a report exists, passes the data to the LLM for analysis. If no report exists, it uploads the file and returns the scan_id.
– `/scanurl
– `/ioc
– `/explain
– `/help` – Display available commands.
The message handler logic should differentiate between commands, text messages, and document uploads. For example, when a user sends a file, the bot can automatically invoke the file‑scanning routine without an explicit command, mirroring a true assistant experience.
6. Deployment on Replit: Mobile‑Friendly Hosting
Replit’s mobile app (iOS/Android) allows you to write, run, and debug code directly from your phone. Create a new Python repl, paste your bot code, and add the required secrets (BOT_TOKEN, VT_API_KEY, OPENROUTER_API_KEY) in the Secrets tab. The bot runs in a container that stays alive as long as the repl is open. For persistent 24/7 operation, Replit offers Autoscale or Scheduled deployment plans. However, as the original builder noted, the subscription cost can be a barrier. An alternative is to deploy on free tiers of Render or Railway, or use a keep‑alive script that pings the bot’s webhook every few minutes.
Debugging on Mobile
Replit’s built‑in console and error logs are accessible from the mobile app. Use `print()` statements generously to trace API responses. Since mobile screens are small, structure your logs concisely. The bot can also send error details to a private Telegram channel for remote monitoring.
7. Cost Considerations and Trade‑Offs
Building a proof of concept is inexpensive: VirusTotal’s free tier, OpenRouter’s free credits, and Replit’s free plan suffice for development. However, production‑grade usage incurs costs:
- VirusTotal: Premium API keys are required for higher rate limits and additional features.
- OpenRouter: Each LLM call has a token‑based cost; choose smaller, faster models for routine tasks to save credits.
- Hosting: Replit’s always‑on feature requires a paid subscription ($7–$30/month). Alternatively, use a low‑cost VPS or serverless functions.
The original builder’s bot eventually stopped running due to Replit’s subscription expense – a realistic constraint for independent security researchers. To mitigate this, consider scheduling the bot to run only during working hours or using a free hosting provider with a webhook (instead of polling) to reduce resource consumption.
What Undercode Say
- Key Takeaway 1: A capable SOC assistant can be built entirely on a mobile device, democratising access to advanced threat intelligence and AI reasoning for analysts who lack traditional workstations.
- Key Takeaway 2: The integration of VirusTotal’s API with an LLM via OpenRouter creates a powerful synergy – raw detection data is transformed into actionable, plain‑language guidance, bridging the gap between automated scanning and human decision‑making.
Analysis: This project exemplifies the “no‑laptop‑no‑problem” ethos, proving that resourcefulness and modern cloud APIs can overcome hardware limitations. The bot’s architecture is modular, allowing easy swapping of threat intelligence sources (e.g., integrating AbuseIPDB, Shodan) or LLM providers. However, the cost of always‑on hosting remains a stumbling block for hobbyists. A potential workaround is to use Telegram’s webhook feature with a free serverless platform (e.g., Cloudflare Workers) that only executes on demand, eliminating idle costs. Security‑wise, storing API keys as environment variables is a must, and the bot should sanitise user inputs to prevent injection attacks. The concept also raises interesting possibilities for collaborative SOCs – imagine a shared Telegram bot that aggregates threat intelligence from multiple analysts, creating a crowd‑sourced early‑warning system. While the current implementation is a proof of concept, it lays the groundwork for a new class of mobile‑first security tools that empower analysts to respond from anywhere, at any time.
Prediction
- +1 Over the next 12–18 months, we will see a surge in mobile‑first security automation tools, driven by the ubiquity of smartphones and the decreasing cost of LLM APIs. SOC teams will adopt lightweight “pocket analysts” for triage during off‑hours or when travelling.
- +1 OpenRouter’s unified model access will become a standard component in security bots, enabling teams to switch between models (e.g., using a cheaper model for routine IOC checks and a premium model for complex incident analysis) without code changes.
- -1 The reliance on third‑party APIs introduces supply‑chain risks – if VirusTotal or OpenRouter experiences downtime, the bot becomes non‑functional. Organisations must implement fallback mechanisms (e.g., local ClamAV scanning, offline LLM) to maintain resilience.
- -1 Cost barriers will prevent widespread adoption among independent researchers and small businesses unless hosting providers introduce more generous free tiers or usage‑based pricing that aligns with sporadic bot usage.
- +1 The success of such mobile‑built projects will encourage more cybersecurity professionals to share their “building in public” journeys, fostering a community of practice that accelerates innovation in accessible security tooling.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Lekan Adegbola – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
