Astra
9b76ef4041
Extends the reserved-usernames doc with a vulgar/offensive section, adds CSV exports (username,reason) for both the categorized reserved-usernames list and a filtered snapshot of fragment.com's sold usernames, and adds a scripts/reserve_usernames.py CLI to bulk-feed a CSV into the admin panel's reserved-usernames blocklist via the real login -> CSRF -> reserve-username API flow.
93 lines
5.1 KiB
Markdown
93 lines
5.1 KiB
Markdown
# Suggested reserved usernames
|
|
|
|
A starter blocklist for `TELESRV_RESERVED_USERNAMES` (see
|
|
`internal/config/config.go`, `ReservedUsernames`), beyond the shipped
|
|
default (`owpengram, admin, administrator, support, staff, moderator,
|
|
official, root, owner`). The mechanism blocks these, case-insensitively,
|
|
from self-service `account.updateUsername` / `channels.updateUsername` —
|
|
an operator can still assign one deliberately from the admin panel, since
|
|
that's not the squatting this exists to stop.
|
|
|
|
Organized by why each entry is worth blocking. Trim or extend per your own
|
|
deployment — none of this is enforced by the server itself, it's just a
|
|
starting list to feed into the env var.
|
|
|
|
The same entries, one per line as `username,reason`, are in
|
|
[reserved-usernames.csv](reserved-usernames.csv) — that's the format
|
|
`scripts/reserve_usernames.py` reads, for feeding this list straight into the
|
|
admin panel's reserved-usernames blocklist (a per-username admin action,
|
|
distinct from `TELESRV_RESERVED_USERNAMES`) instead of the env var.
|
|
|
|
## Official-sounding / staff-impersonation
|
|
|
|
Names that would read as "this account speaks for the operator" if a
|
|
random user grabbed them.
|
|
|
|
```text
|
|
telegram, telegramofficial, telegramsupport, telegramteam, telegramstaff,
|
|
telegramhq, telegramnews, telegramnotifications, telegramverify, telegrambot,
|
|
telegramservice, security, securityteam, verify, verification, verified,
|
|
helpdesk, helpcenter, customerservice, customersupport, servicedesk, service,
|
|
system, systemmessage, systembot, notifications, notification, alerts,
|
|
announcements, announcement, newsroom, press, pressoffice, spambot, antispam,
|
|
abuse, abusereport, reports, legal, compliance, billing, payments, finance,
|
|
accounts, accountservices, recovery, unlock, restore, backup, headquarters,
|
|
staffteam, modteam, moderation, moderators, founder, cofounder, management
|
|
```
|
|
|
|
## Founders / executives (real people this server is not affiliated with)
|
|
|
|
Blocks an account from presenting as Telegram's actual leadership.
|
|
|
|
```text
|
|
durov, pavel, paveldurov, pdurov, nikolai, nikolaidurov, ndurov, durovpavel,
|
|
telegramceo, telegramfounder
|
|
```
|
|
|
|
## Crypto / scam-bait
|
|
|
|
The classic "free crypto giveaway" impersonation targets — official-sounding
|
|
project/exchange names, plus generic scam-pattern handles.
|
|
|
|
```text
|
|
bitcoin, ethereum, toncoin, tonwallet, tonfoundation, crypto, cryptowallet,
|
|
wallet, airdrop, giveaway, bonus, freecoins, claim, claimnow, binance,
|
|
coinbase, kraken, metamask, trustwallet, ledger, opensea, uniswap, elonmusk,
|
|
tesla, spacex, cryptosupport, walletsupport, tonsupport, binancesupport,
|
|
investment, investmentteam, forextrading, tradingbot, signals, cryptosignals
|
|
```
|
|
|
|
## Vulgar / offensive
|
|
|
|
Common profanity and slurs worth blocking outright, independent of any
|
|
impersonation angle. Limited to entries of 5+ characters, since anything
|
|
shorter is already unreachable through self-service `account.updateUsername`
|
|
/ `channels.updateUsername` (5-character length floor). Not included in the
|
|
`TELESRV_RESERVED_USERNAMES` suggestion below - add these separately if your
|
|
deployment wants them.
|
|
|
|
```text
|
|
fucker, fucking, motherfucker, bullshit, asshole, bitch, bastard, dickhead,
|
|
pussy, whore, nigger, nigga, faggot, retard, rapist, pedophile, hitler
|
|
```
|
|
|
|
## Suggested env var
|
|
|
|
Comma-separated, matching `envListOr`'s parsing:
|
|
|
|
```bash
|
|
TELESRV_RESERVED_USERNAMES=owpengram,admin,administrator,support,staff,moderator,official,root,owner,telegram,telegramofficial,telegramsupport,telegramteam,telegramstaff,telegramhq,telegramnews,telegramnotifications,telegramverify,telegrambot,telegramservice,security,securityteam,verify,verification,verified,helpdesk,helpcenter,customerservice,customersupport,servicedesk,service,system,systemmessage,systembot,notifications,notification,alerts,announcements,announcement,newsroom,press,pressoffice,spambot,antispam,abuse,abusereport,reports,legal,compliance,billing,payments,finance,accounts,accountservices,recovery,unlock,restore,backup,headquarters,staffteam,modteam,moderation,moderators,founder,cofounder,management,durov,paveldurov,pdurov,nikolai,nikolaidurov,ndurov,durovpavel,telegramceo,telegramfounder,bitcoin,ethereum,toncoin,tonwallet,tonfoundation,crypto,cryptowallet,wallet,airdrop,giveaway,bonus,freecoins,claim,claimnow,binance,coinbase,kraken,metamask,trustwallet,ledger,opensea,uniswap,elonmusk,tesla,spacex,cryptosupport,walletsupport,tonsupport,binancesupport,investment,investmentteam,forextrading,tradingbot,signals,cryptosignals
|
|
```
|
|
|
|
## What this doesn't cover
|
|
|
|
- **Collectible usernames** (`internal/admin/service.go` collectible-username
|
|
actions) go through the admin panel/Admin API directly and aren't gated
|
|
by this list at all — an operator minting one bypasses it on purpose.
|
|
- **Prefix/substring squatting** (`telegram_real`, `xtelegram`, `te1egram`)
|
|
— the blocklist is an exact-match (case-insensitive) list, not a pattern
|
|
matcher, so lookalike spellings need their own entries if you want them
|
|
blocked too.
|
|
- This is a *username* blocklist only — it says nothing about display
|
|
names, bios, or profile photos, which can impersonate just as easily and
|
|
aren't restricted by `TELESRV_RESERVED_USERNAMES` at all.
|