Telegram scam channels are an economy. Mirror clones, fake support desks, and giveaway farms all follow the same production pattern - and public metadata exposes every one of them, no login required.
I built detection rules for a scam-channel corpus last month. The five that caught the most:
1. The age-velocity mismatch. t.me/s/<channel> previews expose post IDs, which are sequential per channel. Sample the first and last post you can reach: post IDs / channel age gives posting velocity. Scam clones post 20-60 posts/day for two weeks, then go dark - the lifecycle of a paid promotion burst. Legitimate channels post steadily for months.
2. The clone fingerprint. Scam operators mass-produce channels by copying a real channel's content. Normalized-text fingerprints (MinHash over post bodies) across channels you've collected reveal the copies: identical paragraph blocks, shifted timestamps, one channel clearly first. The earliest publisher is the source; the cluster around it is the farm.
3. The username entropy test. Channel handles registered in batches show structural patterns: news_24_7_daily, news_24_7_alerts, news_24_7_brief. You do not need ML for this - a trigram similarity check against handles you've already seen in your corpus flags sibling registrations instantly.
4. The bio link direction test. Scam channels exist to move traffic. Their posts link out to external domains at a rate 5-10x legit news channels, and the link targets rotate across registrar-similar domains. Track link-out density per channel; it is a motive detector.
5. The view-curve cliff. Public previews show per-post view counts for channels over ~1000 subscribers. Bought audiences show a flat view line regardless of content; organic channels show decay curves with variance. Flat + high subscriber count + young channel = purchased audience. One data point, one conclusion.
The full rule set (with the regexes, thresholds, and the scoring sheet I run every candidate channel through) lives in the Telegram & Web OSINT Bundle ($5). Sample brief, free: here.
Everything above runs on GitHub Actions with zero servers. Questions welcome.
Top comments (0)