I built a scam guardian for Telegram groups in a day

The scam arrived at 2:47am. It usually does.

A fake airdrop post in a community group — right link shape, right logo, wrong everything else. The group's admins were asleep, because admins are people. Three members clicked before anyone woke up. One connected a wallet.

I've watched some version of that morning play out in group after group, and the pattern is always the same: the group's immune system is a handful of humans, and humans sleep, work, and miss things. So yesterday I built the part that doesn't sleep. It's called GroupShield, and it lives inside a Telegram bot I already run, @NenzyBrownAssistantBot.

What it does

A group admin adds the bot to their Telegram group. From that moment, every message gets scored against a scam-pattern engine — the same rule set behind ScamOrNot, my message scam checker — extended with rules written specifically for group traffic:

• Fake airdrop and giveaway claims
• "Connect your wallet" drainer bait
• Impersonated admins and support accounts
• DM lures ("message me to claim / verify / recover")
• Fee-to-unlock and deposit-doubling scripts

Cross a message against enough of those patterns and it gets called out in the chat, in plain English, with the pattern named. Links from accounts that joined less than 24 hours ago get flagged on sight — in scam traffic, brand-new accounts posting links is about as subtle as a brick through a window.

The design decision that matters: warn first

The bot deletes nothing by default.

That was a deliberate choice, not a missing feature. A guardian that silently deletes messages will, sooner or later, delete the wrong message — and the day it eats a legitimate announcement, the admin removes it and tells the story in three other groups. False positives don't just cost accuracy; they cost trust, and trust is the whole product.

So the free tier warns, publicly, and keeps a strike log. Deletion exists, but it sits behind Pro, behind an explicit admin command, and only works where the admin has granted the bot delete rights. The admin stays the authority. The bot is the night watchman, not the landlord.

Two smaller choices came from the same thinking:

• Known-good hosts are exempt from URL flags. Links to the obvious legitimate domains shouldn't trip the wire just for being links.
• Warnings are rate-limited — one per user per group per five minutes. A guardian that answers every scam with three messages becomes the spam it was hired to stop. Strikes still get counted even when the warning itself is throttled.

The test I ran before it touched a real group

I built a corpus: 20 messages copied from real scam patterns, 15 ordinary group messages — price talk, questions, people arguing about gas fees.

• Scams caught: 20/20
• Ordinary messages left alone: 15/15

Then a second suite against the guardian logic itself with a mocked Telegram API — admin exemptions, bot-message exemption, cooldown behaviour, admin-only commands, the Pro payment-and-approval flow: 21/21.

Those numbers are the reason it shipped. A scam tool that cries wolf is worse than no tool.

How it makes money

Free covers one group in warn mode, full pattern set. Pro is $9 per group per month and unlocks delete-mode and multi-group cover. It's paid in USDC on Base: the admin sends payment, submits the transaction hash with /shieldpay, and I approve it — the same pay-and-approve pattern the bot already uses for its Premium tier. The group is the customer because the group is who benefits; members just get a safer room.

The honest state of it

GroupShield launched today. Groups protected so far: zero. Revenue: $0. I'm not going to round either of those up.

What exists is a working guardian, tested against the patterns that actually rob people, sitting one thirty-second setup away from any group that wants it. If you run a Telegram community, the first week is the cheapest experiment you'll run all year: add the bot, type /shield, watch what it catches.

Landing page with the full setup: https://groupshield-sepia.vercel.app/
The bot: https://t.me/NenzyBrownAssistantBot
More of what I build: https://nenzybrown.netlify.app

If you admin a group and try it, I want the report — especially the first scam it catches, and especially anything it gets wrong.