Solutions to the problem of spam bots added to telegram groups

Hey. I am the author of several popular bots for administering telegram groups: @daysandbox , @watchdog_robot and others. Every day in the support group and in private messages I see the same question: how can I protect myself from spam bots added to the group. Usually they also specify that these are Arab spam bots. People are trying to find an anti-spam bot that will remove links, delete messages with Arabic characters, delete users with Arabic characters in names and stuff like that. But these are all consequences, and in many cases the cause is one and the same and it is easy to correct it. The reason is simple, but not obvious.

What is the uniqueness of the problem of spam bots added to the group? Telegram bots do not see messages from other telegram bots. Even if you already have bots installed in the group that remove links, Arabic characters and other things, even if they forbid new members to write messages until new members click a button or pass some kind of test, this does not help spam

Spam appears in the following scenario:

• group member adds spam bot to group
• anti-spam bot sees the fact of adding a bot
• anti-spam bot, calls the telegram API method, restricting the spam bot to write messages to the group. For example, he does this for all new users or only for those whose login contains the word "bot" at the end. It doesn’t matter.
• Some time elapses between the moment a spam bot enters a group and the server’s telegrams process a request to restrict this bot to write chat rights. At this point, the spam bot can send a message to the chat.
• The anti-spam bot does not see this message, because bots do not see messages from other bots. This is how telegrams work.

The considered scenario shows that it is not always possible to deal with the consequences of added bots. It’s more effective to deal with the reason - the ability to add bots to a group by group members.

There are two types of telegram groups: public and private. The type of group determines what administrators, ordinary users, and bots can do inside the group and how. A prerequisite for a public group is the existence of a link of the form " https://t.me/XXX ", by which you can enter the group. For a private group, a login link is not required.

Consider the process of creating a group from scratch. Create a group with default settings. We will get a private group without an invitation link. Let's try to add any bot as a simple member of the group. Added! How to solve a problem? The only way to prohibit adding bots to a private group is to prohibit manually adding any new members at all, this is done using the checkbox "Group Management -> Permissions -> Add Members". This will limit only ordinary users, group administrators will still be able to add new members (and bots) by hand.

With the simplest case sorted out. Now create an invitation link to enter the group: "Group Management-> Group Information -> Invitation Link -> Create Invitation Link". We will get a link of the form " https://t.me/joinchat/ ...". An invitation link is created for each administrator, initially only the administrator who created it knows it. Now the administrator can place this link where he sees fit, and any user can join the chat using this link. At any time, the administrator can generate a new invitation link, while the old link will stop working.

Important note: spam bots cannot enter the group by invitation link. A spam bot (and any bot in general) can enter the chat only if someone manually adds the bot there. The most common reason for spam bots to appear in private chats is when administrators create invitation links but don’t disable (through Group Management -> Permissions) the ability to manually add new users.

Now let's see what happens if we transfer a group from private to public mode using "Group Management -> Group Information -> Public Group". We will also have to come up with a public address of the form " https://t.me/XXX ", without this we cannot make the group public. Let it be " https://t.me/habr_test ". What is the difference between a public group and a private group that has an invitation link? A public group can be found through an internal telegram search, and you can also see any group message via the web at " https://t.me/habr_test/X ", where X is the message sequence number in the group.

So, our group has become public, it has changed the properties of visibility, and not only. The most interesting thing is that you can no longer invite bots to it. If it is allowed to invite new users in "Group Management -> Permissions", then users can invite new users, but only ordinary people, not bots. When you try to add a bot, the error "Failed to add user. Try again later." What you need!

Conclusion. The immunity from infecting a group with bots gives one of two actions:

• prohibiting regular participants from adding bots (Group Management -> Permissions)
• transferring the group to public mode i.e. assigning to the group an address of the form " https://t.me/habr_test "

PS The title of the article is a little clickbait. Of course, a lot of telegram spam is generated not by bot-API bots, but by bots using ordinary user accounts, but the problem and its solution, described in the article, have a place to be. And they have a place to be every day, and I hesitated to answer the same questions on the same questions, therefore I wrote this article.

UPD: Made a bot that automatically deletes messages containing Arabic characters, and also removes new users whose names have Arabic characters. Just install the @noarab_bot bot in the chat and give it the right to delete messages and ban users. Bot documentation: https://tgdev.io/bot/noarab_bot

UPD2: If for one reason or another it is impossible to make the group public or prohibit the addition of the group to a private group, then you can use the @watchdog_robot bot with the "bot" filter - watchdog will delete the bots immediately after someone added them to the chat.