Solutions to the problem of spam bots added to telegram groups

Hey. I am the author of several popular bots for administering telegram groups: @daysandbox , @watchdog_robot, and others. Every day in the support group and in personal messages I see the same question: how do I protect myself from spam bots added to the group. Usually, they clarify that these are Arab spam bots. People are trying to find an anti-spam bot that will delete links, delete messages with Arabic characters, delete users with Arabic characters in names and stuff like that. But these are all consequences, and in many cases the reason is the same and it is easy to fix. The reason is simple, but not obvious.

What is the uniqueness of the problem of spam bots added to the group? Telegram bots do not see messages from other telegram bots. Even if you already have bots in your group that delete links, Arabic characters and other things, even if they prohibit new members of the group from writing messages until new members press a button or pass some kind of test, this does not help prevent spam

Spam appears in the following scenario:

• a group member adds a spam bot to the group
• anti-spam bot sees bot adding
• anti-spam bot, calls the telegram API method, which limits the spam-bot in writing messages to the group. For example, it does this for all new users or only for those whose login contains the word "bot" at the end. This is not the point.
• Some time passes between the time when the spam bot enters the group and processes the server telegrams of the request to restrict this bot to write to the chat. At this point, the spam bot can send a chat message.
• The anti-spam bot does not see this message, because bots do not see messages from other bots. This is how telegrams work.

The considered scenario shows that it is not always possible to deal with the effects of bots added. It is more effective to deal with the cause - the possibility of adding bots to a group by group members.

There are two types of group telegrams: public and private. The type of group determines what and how administrators, ordinary users and bots can do inside the group. An obligatory condition for a public group is the existence of a link of the form " https://t.me/XXX ", by which you can enter the group. For a private group, having a login link is not required.

Consider the process of creating a group from scratch. Create a group with default settings. We will have a private group without an invitation link. Let's try to add any bot to a simple member of the group. Added! How to solve a problem? The only way to prohibit adding bots to a private group is to prohibit manually adding any new members at all, this is done with the help of the "Manage group -> Permissions -> Add members" checkbox. This will limit only ordinary users; group administrators will still be able to add new members (and bots) with their hands.

With the simplest case sorted out. Now create an invitation link to enter the group: "Manage group-> Group information -> Invitation link -> Create invitation link". Get a link like " https://t.me/joinchat/ ...". A separate invitation link is created for each administrator, initially only the administrator who created it knows it. Now the administrator can place this link where it sees fit, and any user can connect to the chat via this link. At any time, the administrator can generate a new invitation link, and the old link will no longer work.

Important note: spam bots cannot enter the group via an invitation link. A spam bot (and any bot in general) can get into the chat only if someone adds a bot there manually. The most common reason for spam bots in private chat rooms is when administrators create invitation links, but do not disable (through Group Management -> Permissions) the ability to add new users manually.

Now let's see what happens if we transfer a group from private to public mode with the help of "Group Management -> Group Information -> Public Group". We also have to come up with a public address of the form " https://t.me/XXX ", without this it will not work to make the group public. Let it be " https://t.me/habr_test ". What is the difference between a public group and a private group with an invitation link? The public group can be found through the internal telegraph search, and you can also look at any group message via the web at https://t.me/habr_test/X , where X is the sequence number of the message in the group.

So, our group has become public, it has changed the properties of visibility, and not only. The most interesting is that bots can no longer be invited to it. If in "Group Management -> Permissions" it is allowed to invite new users, then users can invite new users, but only ordinary people, not bots. When you try to add a bot, the error "Add user failed. Try again later." What you need!

Conclusion. Immunity from infection by a group of bots gives one of two actions:

• no standard members add bots (Group Management -> Permissions)
• putting the group into public mode i.e. assigning an address to the group of the form " https://t.me/habr_test "

PS The title of the article turned out a bit clickbite. Of course, a lot of telegram spam is not generated by bot-API bots, but by bots using regular user accounts, but the problem and its solution, described in the article, have a place to be. And they have a place to be every day, and I already hesitated to answer the same questions to the same questions, therefore I wrote this article.