Following Orders: A Day in the Life of an Iranian Telegram Bot Farm

Tehran, 6am. A Sony Xperia joins the Telegram channel "Instant loan, no guarantor" for Iran’s central bank, but they aren’t really one of the Iranians who still use the banned platform, and the channel isn’t really Bank Markazi. This account is a bot whose job is to provide social proof for financial scam artists, part of an army of dummy users orchestrated by a sophisticated tech platform to help cybercriminals prey on Iranians. Later tonight, the bot will hit Telegram’s limit of 500 channels, leave the oldest ones, and be ready to begin the cycle anew. 

7am

Eight hours after the order was placed, the Status.DONE event fires for the previous day’s largest purchase: 50,000 followers added to one channel, finally complete. The culmination of hours of processing is visible to us because the databases’s owner has left it unsecured, exposed to anyone on the internet. The 22 million events logged over these 24 hours are, to us, threat intelligence: a detailed view inside one small part of the dark web economy. Across the day it will drive 110,000 accounts to add 1,751,693 followers to Telegram channels — and every bit of that, down to the plaintext passwords, is readable. Even cybercriminals in Iran, it turns out, can't escape the risk of third-party suppliers with poor security practies. With that last of the previous day’s long-runing tasks finished, the farm is read for a new day to begin.

9am

The people of Iran begin their work day. So do the cybercriminals targeting them. While Telegram is used by the criminal underground around the world, it has a place in Iranian society that makes it particularly fertile for internet scams. In response to protests in 2009, the government blocked nearly all other blogging and social media sites, setting off the migration that would eventually make Telegram familiar to half of Iran’s population and home to virtually all its online life. Then the cycle reversed. After Telegram was used to organize another round of protests, the government moved to ban it in 2018. Now Telegram persists in Iranian social life as a massive digital gray market, a de facto second internet despite being officially forbidden. 

Noon

The day is well underway, with activity climbing from 500k events per hour to 1.9M. The demand curve for bots follows the same daily rhythm as the humans behind the channels buying them–as the scam channel operators arrive at their desks, so do the orders for followers to prop up their newest channels.

Many of the channels are not for fraud at all, but simply social media in a country cut off from Facebook and the like. Channels going for a popular aesthetic – posting music, romantic poetry, melancholic imagery – seek to boost their profile without a sinister end, the same reason would-be influencers buy fake followers elsewhere in the world. But hundreds of the purchasing channels are pure financial fraud, impersonating Mehr Iran, Bank Markazi, Bank Resalat, and more. Gambling, crypto, fake investment and forex scams abound just as they do outside Iran. 

Others are culturally specific: sigheh, or nikah mut'ah, is a time-bound marriage that can be as short as a few hours. Reading between the lines, it is sex work fitted to Islamic law. Exam fraud targets young people headed towards Iran’s Konkur, the 4.5-hour test that determines competitive university admission. Fringe interests filling the same space as conspiracy theories in the West offer services like “Occult Sciences Spells.” It’s hard to say whether selling magical spells is truly a scam, but the social proof of fake followers helps grease the wheels of commerce.

3pm

The machine is humming with plenty of orders to fulfill. Each new follower is pushed through the same steps. The system randomly selects one of the 1,558 identities used to log into a proxy. It pulls a device fingerprint – model, OS version, app version — from a library of 1,584 Androids and presents itself to Telegram as Mobogram, an unofficial Iranian fork. Through the proxy it connects and checks whether this account is already at Telegram’s limit of 500 channels per free user. If so, the account enters a separate queue to leave its oldest channel. If successful, it joins the target channel, then archives and mutes the channel to hide the evidence. It will show up in the follower count but not arouse suspicion in the followers list. The process is complete; it drops the connection to Telegram and increments the delivery count. The whole thing takes about five seconds. 

6pm

The flow of orders sustains through the day into the evening, maintaining over a million events per hour. The chokepoints in the system where capacity limits throughput become clear. Each free Telegram account has a hard limit of 500 channels it can join. When that limit is reached, accounts need to leave older channels to free up capacity for new ones. But even actions as small as leaving a Telegram channel require some processing, and that capacity is finite. Each process running on the farm’s servers can manage up to 15 concurrent Telegram sessions. Between the hard caps on channels per account and sessions per process, the number of processes becomes the chokepoint. 

Each process picks up tasks waiting to be done and then logs how many open slots it has. Over the entire log set, 99% of those values are 0, no slots available, new work always waiting to be picked up. Later, when the queue shrinks, the resource pool will also decrease to maintain that optimal 99% utilization–this is a business after all. At the peak, 2,593 process identifiers running 15 connections each will operate a total of 38,895 concurrent Telegram sessions. For now, new orders will have to join the back of the queue. 

9pm

The buyers start to relent - the events drop back to 500k and will remain there through the night. For the most part, the system runs itself. The operator is careful not to get accounts banned, the part of the system most costly to repair. Of the 110k phone numbers, 94% of them with the +98 Iranian country code, only 52 events indicated a forcible logout or account ban. The account pool seems to be growing; fulfilling 1.75M channel joins required only 512K leaves, indicating overall capacity in the system (though this capacity might be reclaimed naturally when the scam channels themselves get banned). When an account does fail to log in, its phone number is sent to a private Telegram channel used by the operator. Only 46 alerts for failed logins today. It could be worse; the operator has exposed the plaintext password for his proxies in every connection event, leaving his accounts open to abuse and disruption. 

Midnight

Long-running orders that take hours to trickle through, like the one completed in the early morning hours, move from the queue to production. These large orders are rare; 44% of orders are for fewer than 1,000 followers, with only a handful for more than 30,000. While the pricing is not present in these logs, comparable services in Iran charge between $0.08–$0.25 per 1,000 members. On an annual basis, the system likely generates $50k-$130k with costs around $600/mo for the proxies, server, and account replenishment. It’s good money. The average salary in Iran is under $8k/year. If our bot farmer is a single person, they are amongst Iran’s top 1% of earners. As a small startup it is still a financial success–and without even taking on the risk of running the scams themselves. Being a vendor in the cybercrime supply chain is lucrative enough.