docs: add vulgar-word/fragment-sold reserved-username lists and CSVs, reserve script

Extends the reserved-usernames doc with a vulgar/offensive section, adds
CSV exports (username,reason) for both the categorized reserved-usernames
list and a filtered snapshot of fragment.com's sold usernames, and adds a
scripts/reserve_usernames.py CLI to bulk-feed a CSV into the admin panel's
reserved-usernames blocklist via the real login -> CSRF -> reserve-username
API flow.

docs/fragment-sold-usernames.csv

@@ -0,0 +1,285 @@
+gaoshou,Chinese slang for 'expert/master'
+danbao,Chinese term for 'guarantee/escrow' - common in gray-market deal-broker slang
+waifu,adult content term
+erotic,adult content term
+playboy,adult content term
+ebank,crypto/finance term
+ether,crypto/finance term
+token,crypto/finance term
+trade,crypto/finance term
+zcash,crypto/finance term
+crypto,crypto/finance term
+tokens,crypto/finance term
+trades,crypto/finance term
+finance,crypto/finance term
+neobank,crypto/finance term
+trading,crypto/finance term
+venture,crypto/finance term
+currency,crypto/finance term
+dogecoin,crypto/finance term
+exchange,crypto/finance term
+investor,crypto/finance term
+memecoin,crypto/finance term
+shitcoin,crypto/finance term
+stockbot,crypto/finance term
+cryptodev,crypto/finance term
+metaverse,crypto/finance term
+cryptocard,crypto/finance term
+cryptofund,crypto/finance term
+polymarket,crypto/finance term
+wallstreet,crypto/finance term
+cryptoholder,crypto/finance term
+investbanker,crypto/finance term
+cocaine,drug reference
+bocai,gambling term/brand
+slots,gambling term/brand
+stake,gambling term/brand
+casino,gambling term/brand
+gamble,gambling term/brand
+betting,gambling term/brand
+jackpot,gambling term/brand
+lottery,gambling term/brand
+gambling,gambling term/brand
+roulette,gambling term/brand
+betmobile,gambling term/brand
+betwinner,gambling term/brand
+blackjack,gambling term/brand
+casino_bot,gambling term/brand
+highroller,gambling term/brand
+agent,generic high-value dictionary word
+ahmed,generic high-value dictionary word
+anime,generic high-value dictionary word
+arena,generic high-value dictionary word
+asset,generic high-value dictionary word
+atlas,generic high-value dictionary word
+banki,generic high-value dictionary word
+beach,generic high-value dictionary word
+black,generic high-value dictionary word
+blood,generic high-value dictionary word
+brute,generic high-value dictionary word
+chart,generic high-value dictionary word
+chats,generic high-value dictionary word
+chess,generic high-value dictionary word
+chief,generic high-value dictionary word
+clown,generic high-value dictionary word
+court,generic high-value dictionary word
+dance,generic high-value dictionary word
+decor,generic high-value dictionary word
+devil,generic high-value dictionary word
+digit,generic high-value dictionary word
+dream,generic high-value dictionary word
+elite,generic high-value dictionary word
+faith,generic high-value dictionary word
+frail,generic high-value dictionary word
+funny,generic high-value dictionary word
+games,generic high-value dictionary word
+gbots,generic high-value dictionary word
+gifts,generic high-value dictionary word
+grand,generic high-value dictionary word
+house,generic high-value dictionary word
+human,generic high-value dictionary word
+karma,generic high-value dictionary word
+knife,generic high-value dictionary word
+local,generic high-value dictionary word
+mango,generic high-value dictionary word
+match,generic high-value dictionary word
+money,generic high-value dictionary word
+multi,generic high-value dictionary word
+north,generic high-value dictionary word
+offer,generic high-value dictionary word
+order,generic high-value dictionary word
+panel,generic high-value dictionary word
+pasta,generic high-value dictionary word
+payme,generic high-value dictionary word
+pizza,generic high-value dictionary word
+plain,generic high-value dictionary word
+plane,generic high-value dictionary word
+plate,generic high-value dictionary word
+point,generic high-value dictionary word
+poker,generic high-value dictionary word
+price,generic high-value dictionary word
+pride,generic high-value dictionary word
+promo,generic high-value dictionary word
+queen,generic high-value dictionary word
+sales,generic high-value dictionary word
+score,generic high-value dictionary word
+seven,generic high-value dictionary word
+sleep,generic high-value dictionary word
+smart,generic high-value dictionary word
+stars,generic high-value dictionary word
+start,generic high-value dictionary word
+store,generic high-value dictionary word
+story,generic high-value dictionary word
+sweet,generic high-value dictionary word
+tiger,generic high-value dictionary word
+today,generic high-value dictionary word
+total,generic high-value dictionary word
+trace,generic high-value dictionary word
+trust,generic high-value dictionary word
+union,generic high-value dictionary word
+viral,generic high-value dictionary word
+watch,generic high-value dictionary word
+weird,generic high-value dictionary word
+woman,generic high-value dictionary word
+world,generic high-value dictionary word
+bridge,generic high-value dictionary word
+buybot,generic high-value dictionary word
+create,generic high-value dictionary word
+credit,generic high-value dictionary word
+desire,generic high-value dictionary word
+dragon,generic high-value dictionary word
+empire,generic high-value dictionary word
+esport,generic high-value dictionary word
+europa,generic high-value dictionary word
+events,generic high-value dictionary word
+family,generic high-value dictionary word
+genius,generic high-value dictionary word
+honest,generic high-value dictionary word
+hotels,generic high-value dictionary word
+island,generic high-value dictionary word
+lonely,generic high-value dictionary word
+misery,generic high-value dictionary word
+monkey,generic high-value dictionary word
+paybox,generic high-value dictionary word
+player,generic high-value dictionary word
+please,generic high-value dictionary word
+poison,generic high-value dictionary word
+police,generic high-value dictionary word
+qrcode,generic high-value dictionary word
+racing,generic high-value dictionary word
+schizo,generic high-value dictionary word
+school,generic high-value dictionary word
+scores,generic high-value dictionary word
+secret,generic high-value dictionary word
+server,generic high-value dictionary word
+sevens,generic high-value dictionary word
+sports,generic high-value dictionary word
+studio,generic high-value dictionary word
+superb,generic high-value dictionary word
+system,generic high-value dictionary word
+ticket,generic high-value dictionary word
+trauma,generic high-value dictionary word
+unreal,generic high-value dictionary word
+videos,generic high-value dictionary word
+wealth,generic high-value dictionary word
+wizard,generic high-value dictionary word
+adviser,generic high-value dictionary word
+airport,generic high-value dictionary word
+balance,generic high-value dictionary word
+bignews,generic high-value dictionary word
+capital,generic high-value dictionary word
+checkup,generic high-value dictionary word
+connect,generic high-value dictionary word
+deposit,generic high-value dictionary word
+domains,generic high-value dictionary word
+easypay,generic high-value dictionary word
+english,generic high-value dictionary word
+fabrika,generic high-value dictionary word
+fishing,generic high-value dictionary word
+fitness,generic high-value dictionary word
+giftbot,generic high-value dictionary word
+lessons,generic high-value dictionary word
+liberty,generic high-value dictionary word
+listing,generic high-value dictionary word
+maestro,generic high-value dictionary word
+message,generic high-value dictionary word
+payment,generic high-value dictionary word
+tickets,generic high-value dictionary word
+tourist,generic high-value dictionary word
+travels,generic high-value dictionary word
+trinity,generic high-value dictionary word
+vehicle,generic high-value dictionary word
+baseball,generic high-value dictionary word
+calendar,generic high-value dictionary word
+checkout,generic high-value dictionary word
+delivery,generic high-value dictionary word
+discount,generic high-value dictionary word
+feedback,generic high-value dictionary word
+football,generic high-value dictionary word
+forecast,generic high-value dictionary word
+innocent,generic high-value dictionary word
+interior,generic high-value dictionary word
+internet,generic high-value dictionary word
+military,generic high-value dictionary word
+nickname,generic high-value dictionary word
+prestige,generic high-value dictionary word
+property,generic high-value dictionary word
+superior,generic high-value dictionary word
+anonymous,generic high-value dictionary word
+celebrity,generic high-value dictionary word
+concierge,generic high-value dictionary word
+insurance,generic high-value dictionary word
+livechart,generic high-value dictionary word
+middleman,generic high-value dictionary word
+nightmare,generic high-value dictionary word
+president,generic high-value dictionary word
+psychopath,generic high-value dictionary word
+realestate,generic high-value dictionary word
+technology,generic high-value dictionary word
+marketplace,generic high-value dictionary word
+hitler,impersonates a real historical figure
+nigga,racial slur
+nigger,racial slur
+alexa,real company/brand name
+apple,real company/brand name
+baidu,real company/brand name
+canon,real company/brand name
+damac,real company/brand name
+emaar,real company/brand name
+fendi,real company/brand name
+gmail,real company/brand name
+gucci,real company/brand name
+huobi,real company/brand name
+insta,real company/brand name
+kamaz,real company/brand name
+msnbc,real company/brand name
+opera,real company/brand name
+pepsi,real company/brand name
+volvo,real company/brand name
+yahoo,real company/brand name
+adidas,real company/brand name
+amazon,real company/brand name
+armani,real company/brand name
+chanel,real company/brand name
+fonbet,real company/brand name
+forbes,real company/brand name
+gitlab,real company/brand name
+nestle,real company/brand name
+nissan,real company/brand name
+openai,real company/brand name
+oracle,real company/brand name
+proton,real company/brand name
+tinder,real company/brand name
+toyota,real company/brand name
+arsenal,real company/brand name
+chatgpt,real company/brand name
+mancity,real company/brand name
+nakheel,real company/brand name
+pandora,real company/brand name
+alphabet,real company/brand name
+coinbase,real company/brand name
+facebook,real company/brand name
+flydubai,real company/brand name
+jpmorgan,real company/brand name
+legoland,real company/brand name
+linkedin,real company/brand name
+meduza,real company/brand name (independent news outlet)
+boris,real person's name
+diana,real person's name
+frank,real person's name
+putin,real person's name
+hayden,real person's name
+anthony,real person's name
+brandon,real person's name
+nicolas,real person's name
+dubai,real place name
+india,real place name
+brazil,real place name
+mexico,real place name
+moscow,real place name
+florida,real place name
+abudhabi,real place name
+portugal,real place name
+russia24,real place name
+bollywood,real place name
+potus,title referring to a real office (President of the United States)

docs/fragment-sold-usernames.md

@@ -0,0 +1,494 @@
+# Fragment.com sold usernames
+
+Snapshot of the 500 usernames shown at <https://fragment.com/?filter=sold> as of
+2026-09-17 (fetched via curl - the page is server-rendered but its results
+aren't paginated past this batch through a plain request). Each of these
+changed hands on Fragment's TON-based marketplace, which makes them a decent
+reference list of squatting targets worth considering for
+`TELESRV_RESERVED_USERNAMES` (see [reserved-usernames.md](reserved-usernames.md))
+beyond the impersonation/profanity angle those entries cover - these are
+blocked purely because they have proven resale value.
+
+Ordered by sale price (TON), highest first.
+
+| Username | Price (TON) |
+|---|---|
+| @danbao | 1,583,948 |
+| @news | 994,000 |
+| @auto | 900,000 |
+| @bank | 850,000 |
+| @avia | 800,000 |
+| @chat | 700,000 |
+| @king | 675,000 |
+| @fifa | 600,000 |
+| @devil | 555,555 |
+| @game | 500,000 |
+| @sber | 471,000 |
+| @meta | 404,000 |
+| @casino | 400,000 |
+| @polymarket | 354,900 |
+| @doge | 350,000 |
+| @hotels | 350,000 |
+| @pizza | 346,000 |
+| @nike | 330,000 |
+| @gram | 313,000 |
+| @play | 302,000 |
+| @alfa | 300,000 |
+| @coin | 300,000 |
+| @cash | 284,000 |
+| @rich | 266,000 |
+| @checkout | 265,000 |
+| @amazon | 262,500 |
+| @ecom | 258,000 |
+| @adidas | 250,000 |
+| @cryptoholder | 250,000 |
+| @defi | 250,000 |
+| @trade | 245,000 |
+| @chief | 242,000 |
+| @trip | 237,000 |
+| @web3 | 224,000 |
+| @fuck | 219,000 |
+| @payment | 207,000 |
+| @fund | 206,000 |
+| @interior | 203,000 |
+| @love | 200,000 |
+| @meet | 200,000 |
+| @secret | 200,000 |
+| @connect | 199,000 |
+| @adviser | 189,000 |
+| @promo | 187,000 |
+| @tiger | 185,000 |
+| @baseball | 179,000 |
+| @mancity | 175,000 |
+| @usdt | 174,000 |
+| @chef | 171,000 |
+| @forecast | 170,000 |
+| @investor | 170,000 |
+| @travels | 170,000 |
+| @jpmorgan | 168,000 |
+| @prestige | 168,000 |
+| @fans | 167,000 |
+| @potus | 165,000 |
+| @balance | 160,000 |
+| @esport | 160,000 |
+| @insurance | 158,000 |
+| @neobank | 158,000 |
+| @dapp | 157,000 |
+| @join | 155,000 |
+| @land | 155,000 |
+| @elite | 154,000 |
+| @crypto | 153,000 |
+| @events | 153,000 |
+| @gold | 151,000 |
+| @lord | 151,000 |
+| @cars | 150,000 |
+| @chart | 150,000 |
+| @mail | 150,000 |
+| @plate | 150,000 |
+| @server | 150,000 |
+| @visa | 150,000 |
+| @sale | 147,000 |
+| @bars | 145,000 |
+| @swap | 145,000 |
+| @msnbc | 141,000 |
+| @start | 140,000 |
+| @scores | 138,000 |
+| @aero | 137,000 |
+| @football | 137,000 |
+| @payme | 137,000 |
+| @union | 137,000 |
+| @poker | 136,500 |
+| @usdc | 136,000 |
+| @checkup | 135,000 |
+| @home | 135,000 |
+| @trauma | 134,669 |
+| @alphabet | 134,000 |
+| @listing | 134,000 |
+| @hack | 133,000 |
+| @bets | 130,000 |
+| @gbots | 130,000 |
+| @name | 130,000 |
+| @paybox | 130,000 |
+| @putin | 130,000 |
+| @queen | 128,000 |
+| @beer | 127,000 |
+| @date | 127,000 |
+| @offer | 127,000 |
+| @data | 126,000 |
+| @food | 126,000 |
+| @dice | 125,000 |
+| @jets | 125,000 |
+| @property | 125,000 |
+| @deal | 122,000 |
+| @host | 120,000 |
+| @bocai | 118,888 |
+| @armani | 115,000 |
+| @dior | 115,000 |
+| @fast | 114,000 |
+| @middleman | 110,250 |
+| @empire | 110,000 |
+| @story | 107,000 |
+| @trust | 107,000 |
+| @oracle | 106,000 |
+| @betting | 105,000 |
+| @token | 105,000 |
+| @ebank | 104,000 |
+| @live | 104,000 |
+| @beta | 103,000 |
+| @doha | 103,000 |
+| @busd | 101,000 |
+| @anime | 100,000 |
+| @canon | 100,000 |
+| @club | 100,000 |
+| @crew | 100,000 |
+| @dogecoin | 100,000 |
+| @elon | 100,000 |
+| @huobi | 100,000 |
+| @list | 100,000 |
+| @porn | 100,000 |
+| @psychopath | 100,000 |
+| @english | 98,000 |
+| @gain | 98,000 |
+| @coke | 97,000 |
+| @earn | 96,000 |
+| @volvo | 96,000 |
+| @csgo | 95,000 |
+| @lottery | 95,000 |
+| @toyota | 94,000 |
+| @openai | 93,331 |
+| @asset | 93,000 |
+| @gate | 93,000 |
+| @money | 92,400 |
+| @bull | 92,000 |
+| @mall | 92,000 |
+| @plus | 92,000 |
+| @point | 92,000 |
+| @aura | 91,000 |
+| @city | 91,000 |
+| @livechart | 91,000 |
+| @pandora | 91,000 |
+| @racing | 91,000 |
+| @chanel | 90,000 |
+| @lion | 90,000 |
+| @nestle | 90,000 |
+| @today | 90,000 |
+| @cafe | 89,000 |
+| @goat | 89,000 |
+| @life | 89,000 |
+| @shib | 89,000 |
+| @stake | 88,200 |
+| @fishing | 88,000 |
+| @nasa | 88,000 |
+| @alexa | 87,000 |
+| @mind | 87,000 |
+| @human | 86,666 |
+| @capital | 86,000 |
+| @dragon | 86,000 |
+| @studio | 86,000 |
+| @funny | 85,000 |
+| @plane | 85,000 |
+| @gifts | 84,000 |
+| @realestate | 84,000 |
+| @lessons | 83,000 |
+| @proton | 83,000 |
+| @asia | 82,000 |
+| @bond | 82,000 |
+| @chats | 82,000 |
+| @expo | 82,000 |
+| @link | 82,000 |
+| @tron | 82,000 |
+| @games | 81,088 |
+| @cast | 81,000 |
+| @court | 81,000 |
+| @dewa | 81,000 |
+| @okex | 81,000 |
+| @webx | 81,000 |
+| @credit | 80,850 |
+| @blackjack | 80,000 |
+| @chatgpt | 80,000 |
+| @dance | 80,000 |
+| @hype | 80,000 |
+| @maestro | 80,000 |
+| @player | 80,000 |
+| @roulette | 80,000 |
+| @nakheel | 79,000 |
+| @neom | 79,000 |
+| @ticket | 79,000 |
+| @tokens | 79,000 |
+| @gems | 78,000 |
+| @match | 78,000 |
+| @pepsi | 78,000 |
+| @trace | 78,000 |
+| @vlog | 78,000 |
+| @sevens | 77,777 |
+| @cctv | 77,000 |
+| @slot | 77,000 |
+| @brazil | 76,000 |
+| @dell | 76,000 |
+| @port | 76,000 |
+| @black | 75,000 |
+| @deposit | 75,000 |
+| @highroller | 75,000 |
+| @score | 75,000 |
+| @total | 75,000 |
+| @cryptofund | 74,000 |
+| @grand | 74,000 |
+| @hell | 74,000 |
+| @ebay | 73,000 |
+| @gucci | 73,000 |
+| @local | 73,000 |
+| @pride | 73,000 |
+| @bitc | 72,331 |
+| @dubai | 72,106 |
+| @xbox | 72,000 |
+| @pass | 71,000 |
+| @agent | 70,000 |
+| @airport | 70,000 |
+| @banki | 70,000 |
+| @core | 70,000 |
+| @erotic | 70,000 |
+| @europa | 70,000 |
+| @gitlab | 70,000 |
+| @smart | 70,000 |
+| @gift | 69,000 |
+| @iqos | 69,000 |
+| @move | 69,000 |
+| @playboy | 69,000 |
+| @code | 68,000 |
+| @digit | 68,000 |
+| @florida | 68,000 |
+| @flydubai | 68,000 |
+| @iran | 68,000 |
+| @knife | 68,000 |
+| @aqua | 67,000 |
+| @dota | 67,000 |
+| @feedback | 67,000 |
+| @file | 67,000 |
+| @house | 67,000 |
+| @lady | 67,000 |
+| @mega | 67,000 |
+| @nude | 67,000 |
+| @watch | 67,000 |
+| @police | 66,666 |
+| @domains | 66,000 |
+| @pets | 66,000 |
+| @tinder | 65,100 |
+| @idea | 65,000 |
+| @kiev | 65,000 |
+| @moon | 65,000 |
+| @ball | 64,000 |
+| @book | 64,000 |
+| @create | 64,000 |
+| @nightmare | 63,800 |
+| @good | 63,000 |
+| @kiss | 63,000 |
+| @plain | 63,000 |
+| @casino_bot | 62,000 |
+| @north | 62,000 |
+| @cure | 61,750 |
+| @best | 61,000 |
+| @audi | 60,000 |
+| @desire | 60,000 |
+| @dzen | 60,000 |
+| @facebook | 60,000 |
+| @island | 60,000 |
+| @sony | 60,000 |
+| @stockbot | 60,000 |
+| @tech | 60,000 |
+| @hitler | 59,000 |
+| @slots | 59,000 |
+| @military | 58,000 |
+| @qiwi | 57,882 |
+| @fitness | 57,000 |
+| @trinity | 57,000 |
+| @hash | 56,000 |
+| @unreal | 56,000 |
+| @cocaine | 55,555 |
+| @fish | 55,000 |
+| @girl | 55,000 |
+| @lonely | 55,000 |
+| @sports | 55,000 |
+| @teen | 54,600 |
+| @stars | 54,500 |
+| @ford | 54,000 |
+| @goal | 54,000 |
+| @vehicle | 54,000 |
+| @exmo | 53,550 |
+| @schizo | 53,550 |
+| @asap | 53,000 |
+| @discount | 53,000 |
+| @hope | 53,000 |
+| @marketplace | 53,000 |
+| @easypay | 52,500 |
+| @arsenal | 52,000 |
+| @trading | 51,660 |
+| @abudhabi | 51,450 |
+| @euro | 51,000 |
+| @nissan | 51,000 |
+| @pasta | 51,000 |
+| @price | 51,000 |
+| @betmobile | 50,000 |
+| @celebrity | 50,000 |
+| @igor | 50,000 |
+| @kamaz | 50,000 |
+| @open | 50,000 |
+| @poison | 50,000 |
+| @time | 50,000 |
+| @india | 49,645 |
+| @atlas | 49,000 |
+| @bridge | 49,000 |
+| @fire | 49,000 |
+| @golf | 49,000 |
+| @linkedin | 49,000 |
+| @mexico | 49,000 |
+| @opera | 49,000 |
+| @soul | 49,000 |
+| @world | 49,000 |
+| @wizard | 48,300 |
+| @calendar | 48,000 |
+| @decor | 48,000 |
+| @gett | 48,000 |
+| @mars | 48,000 |
+| @nickname | 48,000 |
+| @oman | 48,000 |
+| @seven | 48,000 |
+| @tourist | 48,000 |
+| @xbet | 48,000 |
+| @zero | 48,000 |
+| @dawn | 47,000 |
+| @logo | 47,000 |
+| @order | 47,000 |
+| @wifi | 47,000 |
+| @gaoshou | 46,666 |
+| @gamble | 46,544 |
+| @school | 46,200 |
+| @gulf | 46,000 |
+| @drop | 45,000 |
+| @frank | 45,000 |
+| @liberty | 45,000 |
+| @nigga | 45,000 |
+| @please | 45,000 |
+| @insta | 44,500 |
+| @chess | 44,444 |
+| @genius | 44,444 |
+| @message | 44,444 |
+| @hsbc | 44,000 |
+| @kids | 44,000 |
+| @waifu | 43,000 |
+| @karma | 42,069 |
+| @memecoin | 42,069 |
+| @beach | 42,000 |
+| @camp | 42,000 |
+| @weird | 42,000 |
+| @ahmed | 41,948 |
+| @brute | 41,000 |
+| @president | 40,500 |
+| @base | 40,000 |
+| @boss | 40,000 |
+| @buybot | 40,000 |
+| @care | 40,000 |
+| @ether | 40,000 |
+| @fabrika | 40,000 |
+| @fendi | 40,000 |
+| @jackpot | 40,000 |
+| @moscow | 40,000 |
+| @sales | 40,000 |
+| @sleep | 40,000 |
+| @hugo | 39,000 |
+| @arena | 38,000 |
+| @cryptodev | 38,000 |
+| @portugal | 38,000 |
+| @sell | 38,000 |
+| @coinbase | 37,500 |
+| @brandon | 37,357 |
+| @cryptocard | 37,000 |
+| @diana | 37,000 |
+| @faith | 37,000 |
+| @giftbot | 36,750 |
+| @doom | 36,000 |
+| @drug | 36,000 |
+| @dude | 36,000 |
+| @pure | 36,000 |
+| @woman | 36,000 |
+| @pepe | 35,887 |
+| @adam | 35,000 |
+| @army | 35,000 |
+| @russia24 | 35,000 |
+| @boris | 34,900 |
+| @nfts | 34,729 |
+| @innocent | 34,300 |
+| @forbes | 34,000 |
+| @mango | 34,000 |
+| @bignews | 33,834 |
+| @gmail | 33,333 |
+| @exchange | 33,075 |
+| @apple | 33,000 |
+| @anthony | 32,955 |
+| @trades | 32,550 |
+| @blood | 32,000 |
+| @panel | 32,000 |
+| @viral | 32,000 |
+| @baidu | 31,500 |
+| @currency | 31,500 |
+| @ethe | 31,500 |
+| @lava | 31,500 |
+| @tickets | 31,500 |
+| @videos | 31,500 |
+| @wealth | 31,500 |
+| @metaverse | 31,300 |
+| @shitcoin | 31,300 |
+| @multi | 31,000 |
+| @system | 30,335 |
+| @burn | 30,000 |
+| @easy | 30,000 |
+| @finance | 30,000 |
+| @fine | 30,000 |
+| @fonbet | 30,000 |
+| @investbanker | 30,000 |
+| @misery | 30,000 |
+| @ozon | 30,000 |
+| @zcash | 30,000 |
+| @nigger | 29,768 |
+| @anonymous | 29,708 |
+| @store | 29,520 |
+| @cats | 29,500 |
+| @family | 29,000 |
+| @hayden | 29,000 |
+| @top1 | 29,000 |
+| @nicolas | 28,200 |
+| @free | 28,000 |
+| @honest | 27,500 |
+| @superior | 27,300 |
+| @oppo | 27,183 |
+| @gambling | 27,000 |
+| @john | 27,000 |
+| @superb | 27,000 |
+| @monkey | 26,686 |
+| @damac | 26,250 |
+| @delivery | 26,250 |
+| @emaar | 26,250 |
+| @find | 26,250 |
+| @mary | 26,250 |
+| @dream | 26,000 |
+| @quit | 26,000 |
+| @betwinner | 25,424 |
+| @some | 25,309 |
+| @bollywood | 25,000 |
+| @frail | 25,000 |
+| @hero | 25,000 |
+| @ilya | 25,000 |
+| @internet | 25,000 |
+| @meduza | 25,000 |
+| @qrcode | 25,000 |
+| @sweet | 25,000 |
+| @technology | 25,000 |
+| @venture | 25,000 |
+| @yahoo | 25,000 |
+| @grok | 24,890 |
+| @kill | 24,149 |
+| @clown | 24,000 |
+| @wallstreet | 23,725 |
+| @concierge | 23,520 |
+| @jake | 23,334 |
+| @ares | 23,000 |
+| @legoland | 23,000 |

docs/reserved-usernames.csv

@@ -0,0 +1,102 @@
+telegram,official-sounding / staff-impersonation
+telegramofficial,official-sounding / staff-impersonation
+telegramsupport,official-sounding / staff-impersonation
+telegramteam,official-sounding / staff-impersonation
+telegramstaff,official-sounding / staff-impersonation
+telegramhq,official-sounding / staff-impersonation
+telegramnews,official-sounding / staff-impersonation
+telegramnotifications,official-sounding / staff-impersonation
+telegramverify,official-sounding / staff-impersonation
+telegrambot,official-sounding / staff-impersonation
+telegramservice,official-sounding / staff-impersonation
+security,official-sounding / staff-impersonation
+securityteam,official-sounding / staff-impersonation
+verify,official-sounding / staff-impersonation
+verification,official-sounding / staff-impersonation
+verified,official-sounding / staff-impersonation
+helpdesk,official-sounding / staff-impersonation
+helpcenter,official-sounding / staff-impersonation
+customerservice,official-sounding / staff-impersonation
+customersupport,official-sounding / staff-impersonation
+servicedesk,official-sounding / staff-impersonation
+service,official-sounding / staff-impersonation
+system,official-sounding / staff-impersonation
+systemmessage,official-sounding / staff-impersonation
+systembot,official-sounding / staff-impersonation
+notifications,official-sounding / staff-impersonation
+notification,official-sounding / staff-impersonation
+alerts,official-sounding / staff-impersonation
+announcements,official-sounding / staff-impersonation
+announcement,official-sounding / staff-impersonation
+newsroom,official-sounding / staff-impersonation
+press,official-sounding / staff-impersonation
+pressoffice,official-sounding / staff-impersonation
+spambot,official-sounding / staff-impersonation
+antispam,official-sounding / staff-impersonation
+abuse,official-sounding / staff-impersonation
+abusereport,official-sounding / staff-impersonation
+reports,official-sounding / staff-impersonation
+legal,official-sounding / staff-impersonation
+compliance,official-sounding / staff-impersonation
+billing,official-sounding / staff-impersonation
+payments,official-sounding / staff-impersonation
+finance,official-sounding / staff-impersonation
+accounts,official-sounding / staff-impersonation
+accountservices,official-sounding / staff-impersonation
+recovery,official-sounding / staff-impersonation
+unlock,official-sounding / staff-impersonation
+restore,official-sounding / staff-impersonation
+backup,official-sounding / staff-impersonation
+headquarters,official-sounding / staff-impersonation
+staffteam,official-sounding / staff-impersonation
+modteam,official-sounding / staff-impersonation
+moderation,official-sounding / staff-impersonation
+moderators,official-sounding / staff-impersonation
+founder,official-sounding / staff-impersonation
+cofounder,official-sounding / staff-impersonation
+management,official-sounding / staff-impersonation
+durov,impersonates real Telegram leadership
+pavel,impersonates real Telegram leadership
+paveldurov,impersonates real Telegram leadership
+pdurov,impersonates real Telegram leadership
+nikolai,impersonates real Telegram leadership
+nikolaidurov,impersonates real Telegram leadership
+ndurov,impersonates real Telegram leadership
+durovpavel,impersonates real Telegram leadership
+telegramceo,impersonates real Telegram leadership
+telegramfounder,impersonates real Telegram leadership
+bitcoin,crypto / scam-bait impersonation
+ethereum,crypto / scam-bait impersonation
+toncoin,crypto / scam-bait impersonation
+tonwallet,crypto / scam-bait impersonation
+tonfoundation,crypto / scam-bait impersonation
+crypto,crypto / scam-bait impersonation
+cryptowallet,crypto / scam-bait impersonation
+wallet,crypto / scam-bait impersonation
+airdrop,crypto / scam-bait impersonation
+giveaway,crypto / scam-bait impersonation
+bonus,crypto / scam-bait impersonation
+freecoins,crypto / scam-bait impersonation
+claim,crypto / scam-bait impersonation
+claimnow,crypto / scam-bait impersonation
+binance,crypto / scam-bait impersonation
+coinbase,crypto / scam-bait impersonation
+kraken,crypto / scam-bait impersonation
+metamask,crypto / scam-bait impersonation
+trustwallet,crypto / scam-bait impersonation
+ledger,crypto / scam-bait impersonation
+opensea,crypto / scam-bait impersonation
+uniswap,crypto / scam-bait impersonation
+elonmusk,crypto / scam-bait impersonation
+tesla,crypto / scam-bait impersonation
+spacex,crypto / scam-bait impersonation
+cryptosupport,crypto / scam-bait impersonation
+walletsupport,crypto / scam-bait impersonation
+tonsupport,crypto / scam-bait impersonation
+binancesupport,crypto / scam-bait impersonation
+investment,crypto / scam-bait impersonation
+investmentteam,crypto / scam-bait impersonation
+forextrading,crypto / scam-bait impersonation
+tradingbot,crypto / scam-bait impersonation
+signals,crypto / scam-bait impersonation
+cryptosignals,crypto / scam-bait impersonation

docs/reserved-usernames.md

@@ -12,6 +12,12 @@ Organized by why each entry is worth blocking. Trim or extend per your own
 deployment — none of this is enforced by the server itself, it's just a
 starting list to feed into the env var.
 
+The same entries, one per line as `username,reason`, are in
+[reserved-usernames.csv](reserved-usernames.csv) — that's the format
+`scripts/reserve_usernames.py` reads, for feeding this list straight into the
+admin panel's reserved-usernames blocklist (a per-username admin action,
+distinct from `TELESRV_RESERVED_USERNAMES`) instead of the env var.
+
 ## Official-sounding / staff-impersonation
 
 Names that would read as "this account speaks for the operator" if a
@@ -51,6 +57,20 @@ tesla, spacex, cryptosupport, walletsupport, tonsupport, binancesupport,
 investment, investmentteam, forextrading, tradingbot, signals, cryptosignals
 ```
 
+## Vulgar / offensive
+
+Common profanity and slurs worth blocking outright, independent of any
+impersonation angle. Limited to entries of 5+ characters, since anything
+shorter is already unreachable through self-service `account.updateUsername`
+/ `channels.updateUsername` (5-character length floor). Not included in the
+`TELESRV_RESERVED_USERNAMES` suggestion below - add these separately if your
+deployment wants them.
+
+```text
+fucker, fucking, motherfucker, bullshit, asshole, bitch, bastard, dickhead,
+pussy, whore, nigger, nigga, faggot, retard, rapist, pedophile, hitler
+```
+
 ## Suggested env var
 
 Comma-separated, matching `envListOr`'s parsing:

scripts/reserve_usernames.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Bulk-reserve usernames through the telesrv-admin panel API.
+
+Reads a CSV file of `username,reason` lines and calls
+POST /api/actions/reserve-username for each one, using the same
+login -> cookie session -> CSRF token flow the panel frontend uses
+(see docs/admin-panel-api.en.md).
+
+Usage:
+    python3 scripts/reserve_usernames.py \
+        --host https://admin.example.com \
+        --username operator_name \
+        --file usernames.csv
+
+`--username` is your own named admin_console_users account - use the same
+username/password you log into the panel with. (The panel also has an
+"owpengram" break-glass login backed by TELESRV_ADMIN_UI_PASSWORD / _TOKEN,
+but that's a fallback for when the database or named accounts aren't
+available, not something to use day-to-day.) The script prompts for your
+password either way - it's never passed as a CLI argument or stored.
+
+CSV format, one entry per line, no header:
+    somename,squatting on a brand name
+    othername,profanity
+"""
+
+import argparse
+import csv
+import getpass
+import http.cookiejar
+import json
+import sys
+import urllib.error
+import urllib.request
+
+
+def build_opener():
+    jar = http.cookiejar.CookieJar()
+    return urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar)), jar
+
+
+def post_json(opener, url, payload, extra_headers=None):
+    data = json.dumps(payload).encode("utf-8")
+    headers = {"Content-Type": "application/json"}
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method="POST")
+    try:
+        with opener.open(req) as resp:
+            body = resp.read()
+            return resp.status, json.loads(body) if body else {}
+    except urllib.error.HTTPError as e:
+        body = e.read()
+        try:
+            return e.code, json.loads(body) if body else {}
+        except json.JSONDecodeError:
+            return e.code, {"error": body.decode("utf-8", "replace")}
+
+
+def login(opener, host, username, secret):
+    status, resp = post_json(opener, f"{host}/api/login", {"username": username, "secret": secret})
+    if status != 200:
+        raise SystemExit(f"login failed: HTTP {status} {resp}")
+    return resp["csrf_token"]
+
+
+def reserve_username(opener, host, csrf_token, username, reason):
+    status, resp = post_json(
+        opener,
+        f"{host}/api/actions/reserve-username",
+        {"username": username, "reason": reason, "confirm": True},
+        extra_headers={"X-CSRF-Token": csrf_token},
+    )
+    return status, resp
+
+
+def read_entries(path):
+    entries = []
+    with open(path, newline="") as f:
+        for lineno, row in enumerate(csv.reader(f), start=1):
+            if not row or not row[0].strip():
+                continue
+            if len(row) < 2:
+                raise SystemExit(f"{path}:{lineno}: expected 'username,reason', got {row!r}")
+            username = row[0].strip()
+            reason = ",".join(row[1:]).strip()
+            if not username or not reason:
+                raise SystemExit(f"{path}:{lineno}: empty username or reason")
+            entries.append((username, reason))
+    return entries
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--host", required=True, help="panel base URL, e.g. https://admin.example.com")
+    parser.add_argument("--username", required=True, help="your named admin_console_users account")
+    parser.add_argument("--file", required=True, help="CSV file of username,reason lines")
+    args = parser.parse_args()
+
+    host = args.host.rstrip("/")
+    entries = read_entries(args.file)
+    if not entries:
+        raise SystemExit("no entries found in " + args.file)
+
+    secret = getpass.getpass("Password/secret: ")
+
+    opener, _jar = build_opener()
+    csrf_token = login(opener, host, args.username, secret)
+
+    ok, failed = 0, []
+    for username, reason in entries:
+        status, resp = reserve_username(opener, host, csrf_token, username, reason)
+        if status == 200:
+            ok += 1
+            print(f"reserved  {username!r}  ({reason})")
+        else:
+            failed.append((username, reason, status, resp))
+            print(f"FAILED    {username!r}  HTTP {status}  {resp.get('error') or resp.get('message') or resp}")
+
+    print(f"\n{ok}/{len(entries)} reserved")
+    if failed:
+        print(f"{len(failed)} failed:")
+        for username, reason, status, resp in failed:
+            print(f"  {username}: HTTP {status} {resp}")
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()