What a raid looks like
A raid is a coordinated mass join. Dozens of accounts enter a Telegram group within a minute or two, then post the same link, the same insult or the same fake giveaway until nobody can read the chat. The aim may be to push a scam or to bury a conversation.
The accounts are usually new and disposable. One of them is easy to remove by hand. Forty of them at three in the morning, while every admin is asleep, is a different problem. That gap is what raid protection is for.
What raid protection does
Raid protection is a rule about join speed. It counts how many people enter the group in a short window and compares that number with a limit. Below the limit, nothing happens. Above it, the tool treats the newcomers as part of an attack and restricts them before they can post.
It reads the pattern and ignores the content. A filter that reads messages can only react after the spam has been sent. A join counter reacts when the crowd arrives.
How raid protection works in BotLaunch
In BotLaunch, raid protection is one of the moderation modules you switch on for a group from the web dashboard. It does nothing until you enable it. Once it is on, this is how it behaves.
- It counts joins against two limits: joins per minute and joins per hour. The starting values are 10 a minute and 50 an hour, and you can change both.
- When the per-minute limit is reached, each further joiner gets the action you chose for a mass join: warn, mute, captcha, kick or ban.
- Warn posts a warning in the group. Mute stops the member from sending messages. Kick removes the member but lets them join again later. Ban removes them and keeps them out.
- The captcha action, which is the default, mutes the newcomer until the CAPTCHA flow or an admin clears them. A flagged account stays quiet even if the CAPTCHA module is off.
- When the hourly limit is reached and no stronger action applies, newcomers are muted in the same way.
- Premium accounts are skipped by default, and so are accounts that look more than about a month old. Telegram does not tell a bot when an account was created, so the age is estimated from the account's ID number. Treat it as rough.
If the rate keeps climbing, to 20 joins a minute by default, the group goes into lockdown. In lockdown every new joiner gets the mass join action, with no exemptions. An automatic lockdown lasts 30 minutes by default, then the group passes through a short recovery period and returns to normal.
You can also start a lockdown yourself from the dashboard, for example when you see an attack being organised somewhere else. A lockdown you start by hand stays on until you lift it.
Lockdown does not close the group, and it does not silence existing members. People can still join. They are restricted on arrival.
With admin notifications on, the bot sends a direct message to each admin whenever it acts on a joiner. Each detection is also saved with its time, the join count, the action taken and the reasons, and the dashboard shows that history next to running totals.
How it differs from CAPTCHA, anti-flood and anti-spam
All four are moderation modules, and each one watches something different.
- A CAPTCHA checks one newcomer at a time. The person has to prove they are human before they can post, on a quiet day as much as a busy one.
- Anti-flood watches how fast a single member posts and steps in when someone sends too many messages in a row.
- Anti-spam judges the messages themselves and acts on the ones that look like spam.
- Raid protection watches the arrival rate of the whole group and pays no attention to what anyone says.
They overlap on purpose. A raid run by scripted accounts is stopped at the door by the join limit and the CAPTCHA. A raid run by real people can pass a CAPTCHA, and then anti-flood and anti-spam deal with what those people post.
Setting it up this week
- Check that the bot is an admin in the group with the right to restrict and ban members. Without it, no action can be carried out.
- Look at your normal join rate. If a mention in a large channel can send you thirty new members in a minute, a limit of 10 will fire on your best day. Raise it.
- Choose the mass join action. Mute and captcha are reversible, so start there. Pick ban only once you trust your limits.
- Ask every admin to open the bot in a private chat and press Start. Telegram lets a bot message only people who have started it, so an admin who skips this step gets no alerts.
What goes wrong
False alarms come first. A giveaway, a viral post or a mention from a bigger community all look like a raid, because the module sees speed and nothing else. Before a planned promotion, raise the limits. After any busy day, open the history and lift the mute on the people who were caught.
Slow raids are the opposite problem. Accounts that trickle in under the per-minute limit will not trip it. The hourly limit catches some of them, and the rest is work for CAPTCHA and your message filters.
Alerts can be noisy. During a real raid the bot reports each flagged account, so an admin may receive a run of messages. Treat the first one as the cue to open the dashboard.
The last mistake is forgetting a manual lockdown. It has no timer. If you switched it on at night, lift it in the morning, or genuine newcomers will keep being restricted as they arrive.