u/secadmon

Saw the post yesterday about building a hashing pipeline for detecting coordinated copy pasta campaigns on Twitter and wanted to share a real example of the same concept working on Telegram but for catching pig butchering scammers instead of state propaganda.

I'm using a monitoring tool that sits on top of TDLib and watches Telegram group messages. One of the features hashes message content using FNV-1a across every group message and allows anyone to track when the same hash appears in multiple groups within a short time window. Similar idea people were describing in that thread with fuzzy hashing and Levenshtein distance but applied to Telegram in real time.

The cross post detection flagged several accounts that were broadcasting identical messages across multiple crypto groups simultaneously. I looked into what they were posting and it turned out to be pig butchering bait. From there I searched the message content across all my groups and found the same accounts hitting Gate Exchange, BNB Chain Community, Bitget English Official, Filecoin, MEXC and several other crypto groups. The accounts had names like "Treasure Girl", "sophia" and "chaa" with profile photos that are textbook romance scam bait. Generic bios like "Love yourself first, and that's the beginning of a lifelong romance" and "Everything has cracks, that's how the light gets in."

Every message that comes through TDLib gets its text content hashed and stored alongside the sender ID, chat ID and timestamp. When the same content hash from the same sender appears across multiple groups the system flags it as cross posting. It also tracks reply networks and forwarding chains so you can see whether the account ever actually engages with anyone or just drops the same message and moves on. In this case there were zero replies from any of these accounts across any group just pure broadcast behavior.

The whole thing runs locally via TDLib so there's no API middleman and no rate limiting. You're reading the same message stream Telegram delivers to any client, just hashing and correlating it across groups automatically instead of manually searching one group at a time. Happy to answer questions about the detection methodology or share more details on the implementation.

If you're in a lot of crypto groups you know how difficult it is to track all relevant signals. Protocol upgrades, L1 announcements, testnet launches, validator discussions, EIP proposals and ecosystem changes get discussed across dozens of groups but never at the same time.

I've been using an iOS app called Pinnages that has a smart alerts feature where you set up keyword monitors across all your groups at once. Pick keywords like "staking" or "sequencer" or "mainnet migration" and it watches every message in real time and alerts you when they appear anywhere with the source group and message preview.

Beyond keyword monitoring it also does cross group crypto address propagation detection so you can see when the same contract address or wallet is being shared across multiple groups simultaneously. It validates address checksums and tracks which groups are spreading them. Useful for catching coordinated shills or verifying whether a contract making the rounds is the same one across all your groups.

Runs fully on device, no servers, no cloud, no data leaves your phone. Works with any keyword or pattern you care about

Been researching how scammers impersonate group admins on Telegram and the techniques are more sophisticated than I expected. Wanted to share what I've found and see if anyone here has run into similar patterns.

The basic approach is pretty obvious, copy the admin's display name and profile photo then DM group members pretending to be them. But the more advanced ones use Unicode homoglyph substitution to make the display name look identical at a glance. Things like replacing a Latin "a" with a Cyrillic "а" or using zero-width characters to break exact string matching. Visually identical to a human but technically a different string.

I've been building a detection pipeline that layers multiple checks:

1. Normalized string comparison after stripping Unicode lookalikes back to their base characters
2. Name similarity scoring against known admin identities in each group
3. Profile photo similarity detection
4. Account age and activity pattern analysis
5. Cross referencing admin lists across multiple groups to map who the real admins are vs who appeared recently

The homoglyph piece alone has been fun, there are hundreds of Unicode characters that visually match Latin characters across Cyrillic, Greek, Armenian and mathematical symbol blocks which most Telegram clients don't flag for any users.

Has anyone here done work on Telegram identity verification or admin graph mapping across groups? Curious what you've found most reliable for separating legitimate accounts from impersonators especially at scale across dozens or hundreds of groups