Built to catch scams — and to be wrong safely.
A Telegram anti-scam bot: every message passes six signals, clear attacks are removed in under a second in any language, and a lone red flag goes to a human.
- ROLE
- Founder, sole engineer
- COMPANY
- Independent
- TIMELINE
- 2026 — NOW
- SCOPE
- AI integration · Bot architecture · Dashboard · Deploy
- STACK
- 6 SIGNALS
- <1S REMOVAL
- ANY LANGUAGE
- 250+ TESTS
The topic is never the signal. Real communities talk about money constantly.
A generic ruleset flagged four of every fifteen legitimate posts. Qalqon asks the model one question instead: is someone being asked to part with money or credentials before receiving anything? That is why it works in languages it was never tuned for.
Designed, built and deployed solo: a Python bot on python-telegram-bot with an event-driven MVC core; Groq gpt-oss-safeguard-20b for text and a Hugging Face vision classifier for profile photos; SQLite for strikes, trust and events; a read-only FastAPI dashboard; Dockerized behind nginx + Let’s Encrypt.
A cost ladder: cheap checks first, the LLM only when it can still change the outcome.
Keyword filter
Cheap, fast, and always first.
Link analysis
Structural checks for typosquats, homographs and credentials-in-URL.
File analysis
Flags dangerous .apk / .exe attachments of any kind.
LLM intent
Groq gpt-oss-safeguard-20b judges intent rather than topic.
Profile checks
Bio and a deep channel scan over MTProto (Telethon) — only when the message is already suspicious.
Vision
A Hugging Face classifier screens profile photos.
A moderation bot’s worst failure isn’t missing a scam — it’s removing a real member invisibly.
Two signals to act
A suspicious message alone is never enough; the sender’s profile has to agree.
One-tap admin alerts
Ban, Ignore and Whitelist buttons with a detector breakdown; marking a decision wrong clears the strike.
Dry run by default
New deployments report what they would do before they are trusted.
Fails loud
If a provider is down, the verdict is marked degraded — never silently “clean”.
Minimal retention
Ordinary conversation is never stored; only acted-on messages, for 90 days.
Event-driven Model–View–Controller, with a pure policy function at the core.
The Controller translates a Telegram update into a plain message object and decides nothing. The Model holds every rule, and Policy.decide() is a pure function with no I/O. Views subscribe to domain events: the TelegramView deletes, bans and posts alerts; a Digest and AlertBatcher coalesce routine actions; a Heartbeat proves the process is alive.
State lives in SQLite (WAL). The FastAPI dashboard is a separate process that opens the database read-only, so a bug there cannot touch moderation. The bot publishes no ports and runs as one non-root Docker container.