owpengram-server/docs/reserved-usernames.md

Suggested reserved usernames

A starter blocklist for TELESRV_RESERVED_USERNAMES (see internal/config/config.go, ReservedUsernames), beyond the shipped default (owpengram, admin, administrator, support, staff, moderator, official, root, owner). The mechanism blocks these, case-insensitively, from self-service account.updateUsername / channels.updateUsername — an operator can still assign one deliberately from the admin panel, since that's not the squatting this exists to stop.

Organized by why each entry is worth blocking. Trim or extend per your own deployment — none of this is enforced by the server itself, it's just a starting list to feed into the env var.

The same entries, one per line as username,reason, are in reserved-usernames.csv — that's the format scripts/reserve_usernames.py reads, for feeding this list straight into the admin panel's reserved-usernames blocklist (a per-username admin action, distinct from TELESRV_RESERVED_USERNAMES) instead of the env var.

Official-sounding / staff-impersonation

Names that would read as "this account speaks for the operator" if a random user grabbed them.

telegram, telegramofficial, telegramsupport, telegramteam, telegramstaff,
telegramhq, telegramnews, telegramnotifications, telegramverify, telegrambot,
telegramservice, security, securityteam, verify, verification, verified,
helpdesk, helpcenter, customerservice, customersupport, servicedesk, service,
system, systemmessage, systembot, notifications, notification, alerts,
announcements, announcement, newsroom, press, pressoffice, spambot, antispam,
abuse, abusereport, reports, legal, compliance, billing, payments, finance,
accounts, accountservices, recovery, unlock, restore, backup, headquarters,
staffteam, modteam, moderation, moderators, founder, cofounder, management

Founders / executives (real people this server is not affiliated with)

Blocks an account from presenting as Telegram's actual leadership.

durov, pavel, paveldurov, pdurov, nikolai, nikolaidurov, ndurov, durovpavel,
telegramceo, telegramfounder

Crypto / scam-bait

The classic "free crypto giveaway" impersonation targets — official-sounding project/exchange names, plus generic scam-pattern handles.

bitcoin, ethereum, toncoin, tonwallet, tonfoundation, crypto, cryptowallet,
wallet, airdrop, giveaway, bonus, freecoins, claim, claimnow, binance,
coinbase, kraken, metamask, trustwallet, ledger, opensea, uniswap, elonmusk,
tesla, spacex, cryptosupport, walletsupport, tonsupport, binancesupport,
investment, investmentteam, forextrading, tradingbot, signals, cryptosignals

Vulgar / offensive

Common profanity and slurs worth blocking outright, independent of any impersonation angle. Limited to entries of 5+ characters, since anything shorter is already unreachable through self-service account.updateUsername / channels.updateUsername (5-character length floor). Not included in the TELESRV_RESERVED_USERNAMES suggestion below - add these separately if your deployment wants them.

fucker, fucking, motherfucker, bullshit, asshole, bitch, bastard, dickhead,
pussy, whore, nigger, nigga, faggot, retard, rapist, pedophile, hitler

Suggested env var

Comma-separated, matching envListOr's parsing:

TELESRV_RESERVED_USERNAMES=owpengram,admin,administrator,support,staff,moderator,official,root,owner,telegram,telegramofficial,telegramsupport,telegramteam,telegramstaff,telegramhq,telegramnews,telegramnotifications,telegramverify,telegrambot,telegramservice,security,securityteam,verify,verification,verified,helpdesk,helpcenter,customerservice,customersupport,servicedesk,service,system,systemmessage,systembot,notifications,notification,alerts,announcements,announcement,newsroom,press,pressoffice,spambot,antispam,abuse,abusereport,reports,legal,compliance,billing,payments,finance,accounts,accountservices,recovery,unlock,restore,backup,headquarters,staffteam,modteam,moderation,moderators,founder,cofounder,management,durov,paveldurov,pdurov,nikolai,nikolaidurov,ndurov,durovpavel,telegramceo,telegramfounder,bitcoin,ethereum,toncoin,tonwallet,tonfoundation,crypto,cryptowallet,wallet,airdrop,giveaway,bonus,freecoins,claim,claimnow,binance,coinbase,kraken,metamask,trustwallet,ledger,opensea,uniswap,elonmusk,tesla,spacex,cryptosupport,walletsupport,tonsupport,binancesupport,investment,investmentteam,forextrading,tradingbot,signals,cryptosignals

What this doesn't cover

• Collectible usernames (internal/admin/service.go collectible-username actions) go through the admin panel/Admin API directly and aren't gated by this list at all — an operator minting one bypasses it on purpose.
• Prefix/substring squatting (telegram_real, xtelegram, te1egram) — the blocklist is an exact-match (case-insensitive) list, not a pattern matcher, so lookalike spellings need their own entries if you want them blocked too.
• This is a username blocklist only — it says nothing about display names, bios, or profile photos, which can impersonate just as easily and aren't restricted by TELESRV_RESERVED_USERNAMES at all.