# Suggested reserved usernames

A starter blocklist for `TELESRV_RESERVED_USERNAMES` (see
`internal/config/config.go`, `ReservedUsernames`), beyond the shipped
default (`owpengram, admin, administrator, support, staff, moderator,
official, root, owner`). The mechanism blocks these, case-insensitively,
from self-service `account.updateUsername` / `channels.updateUsername` —
an operator can still assign one deliberately from the admin panel, since
that's not the squatting this exists to stop.

Organized by why each entry is worth blocking. Trim or extend per your own
deployment — none of this is enforced by the server itself, it's just a
starting list to feed into the env var.

The same entries, one per line as `username,reason`, are in
[reserved-usernames.csv](reserved-usernames.csv) — that's the format
`scripts/reserve_usernames.py` reads, for feeding this list straight into the
admin panel's reserved-usernames blocklist (a per-username admin action,
distinct from `TELESRV_RESERVED_USERNAMES`) instead of the env var.

## Official-sounding / staff-impersonation

Names that would read as "this account speaks for the operator" if a
random user grabbed them.

```text
telegram, telegramofficial, telegramsupport, telegramteam, telegramstaff,
telegramhq, telegramnews, telegramnotifications, telegramverify, telegrambot,
telegramservice, security, securityteam, verify, verification, verified,
helpdesk, helpcenter, customerservice, customersupport, servicedesk, service,
system, systemmessage, systembot, notifications, notification, alerts,
announcements, announcement, newsroom, press, pressoffice, spambot, antispam,
abuse, abusereport, reports, legal, compliance, billing, payments, finance,
accounts, accountservices, recovery, unlock, restore, backup, headquarters,
staffteam, modteam, moderation, moderators, founder, cofounder, management
```

## Founders / executives (real people this server is not affiliated with)

Blocks an account from presenting as Telegram's actual leadership.

```text
durov, pavel, paveldurov, pdurov, nikolai, nikolaidurov, ndurov, durovpavel,
telegramceo, telegramfounder
```

## Crypto / scam-bait

The classic "free crypto giveaway" impersonation targets — official-sounding
project/exchange names, plus generic scam-pattern handles.

```text
bitcoin, ethereum, toncoin, tonwallet, tonfoundation, crypto, cryptowallet,
wallet, airdrop, giveaway, bonus, freecoins, claim, claimnow, binance,
coinbase, kraken, metamask, trustwallet, ledger, opensea, uniswap, elonmusk,
tesla, spacex, cryptosupport, walletsupport, tonsupport, binancesupport,
investment, investmentteam, forextrading, tradingbot, signals, cryptosignals
```

## Vulgar / offensive

Common profanity and slurs worth blocking outright, independent of any
impersonation angle. Limited to entries of 5+ characters, since anything
shorter is already unreachable through self-service `account.updateUsername`
/ `channels.updateUsername` (5-character length floor). Not included in the
`TELESRV_RESERVED_USERNAMES` suggestion below - add these separately if your
deployment wants them.

```text
fucker, fucking, motherfucker, bullshit, asshole, bitch, bastard, dickhead,
pussy, whore, nigger, nigga, faggot, retard, rapist, pedophile, hitler
```

## Suggested env var

Comma-separated, matching `envListOr`'s parsing:

```bash
TELESRV_RESERVED_USERNAMES=owpengram,admin,administrator,support,staff,moderator,official,root,owner,telegram,telegramofficial,telegramsupport,telegramteam,telegramstaff,telegramhq,telegramnews,telegramnotifications,telegramverify,telegrambot,telegramservice,security,securityteam,verify,verification,verified,helpdesk,helpcenter,customerservice,customersupport,servicedesk,service,system,systemmessage,systembot,notifications,notification,alerts,announcements,announcement,newsroom,press,pressoffice,spambot,antispam,abuse,abusereport,reports,legal,compliance,billing,payments,finance,accounts,accountservices,recovery,unlock,restore,backup,headquarters,staffteam,modteam,moderation,moderators,founder,cofounder,management,durov,paveldurov,pdurov,nikolai,nikolaidurov,ndurov,durovpavel,telegramceo,telegramfounder,bitcoin,ethereum,toncoin,tonwallet,tonfoundation,crypto,cryptowallet,wallet,airdrop,giveaway,bonus,freecoins,claim,claimnow,binance,coinbase,kraken,metamask,trustwallet,ledger,opensea,uniswap,elonmusk,tesla,spacex,cryptosupport,walletsupport,tonsupport,binancesupport,investment,investmentteam,forextrading,tradingbot,signals,cryptosignals
```

## What this doesn't cover

- **Collectible usernames** (`internal/admin/service.go` collectible-username
  actions) go through the admin panel/Admin API directly and aren't gated
  by this list at all — an operator minting one bypasses it on purpose.
- **Prefix/substring squatting** (`telegram_real`, `xtelegram`, `te1egram`)
  — the blocklist is an exact-match (case-insensitive) list, not a pattern
  matcher, so lookalike spellings need their own entries if you want them
  blocked too.
- This is a *username* blocklist only — it says nothing about display
  names, bios, or profile photos, which can impersonate just as easily and
  aren't restricted by `TELESRV_RESERVED_USERNAMES` at all.