In recent months, we have been seeing accounts with openly sexual photos on our Telegram channel dev.ua. They have been actively commenting on all posts, no matter what they are about — Elon Musk’s latest lies, the financial results of the Ukrainian IT market, or the work stories of recruiters. Moreover, comments from such accounts appeared under the posts almost immediately after publication, which led to the obvious thought — they were generated automatically, although they usually even correspond to the topic of the news or article. Of course, in parallel with this, all Telegram users have long seen an influx of such «slutbots» in certain news and political Telegram channels with a large audience. It is obvious that it is the size of the channel’s audience that is a kind of magnet for them.
However, in the end, we decided to figure out what it is — a scam, «Onlyfans for the poor,» online prostitution sites? Is it a systemic coordinated phenomenon on the scale of certain networks managed by conditional «offices,» or just individual «private initiatives»? Who and how much can earn from this and how does it work technically? And also — does it pose a danger to personal data, loss of a Telegram account, the threat of theft of funds, etc. To do this, we ourselves investigated individual accounts, and also asked cybersecurity expert and white hat hacker Mykyta Knysh, Cybersecurity & Emerging Tech Consultant Vyacheslav Davydenko, and specialists from Netpeak to comment on this topic.
Discounts on nudes for the Armed Forces of Ukraine vs payment in rubles
Let’s say right away — TG accounts with candid avatars often have a different nature. The absolute majority of those that the author reviewed immediately offered a link to a closed Telegram channel, a subscriber of which you can become for a certain amount of money. For example, 500 UAH — one-time. There, the girl (or the channel admin, who could potentially be a bearded man of pre-retirement age) undertakes to publish her pornographic photos and videos specifically to her subscribers. Actually, why not Onlyfans?
The author received an offer to drop his precious 500 UAH and become a subscriber to the channel from one of such accounts, which, for example, are massively «grazed» in the comments on the Telegram channel of the People’s Deputy Oleksiy Honcharenko. The admin and model of this channel «lured» a potential subscriber in my person with frank «samples» (the photos disappeared immediately after viewing) and dropped the card number of the Ukrainian bank Globus for payment.
In my opinion, it is obvious that the bank was also chosen by non-Privat and Mono to avoid identifying the name and surname through their popular mobile applications. Nevertheless, the admin of this pornographic tg channel even gave the impression of a real girl, because in parallel with the sex content she shared stories from her life and adequately responded to messages. Additional proof of reality — the interior details in her photo are the same. And also — she led the channel in beautiful Ukrainian and offered a discount on her nudes for those who serve in the Armed Forces of Ukraine. So this is almost a virtual one love, and if I really dropped my 500 UAH to someone from the participants of this opaque market — it would be her. But, by the way, side by side with her in the comments of the same people’s deputy, a certain Vasilisa offered a subscription to her channel in Russian rubles. She doesn’t have any personal communication — instead, she has a bot set up with services and prices.
In parallel with this, accounts of a slightly different type were also noticed — also with frank (but more erotic than pornographic) photos. However, without any links to «private» and automated bots. Here, everyone who wants to has the opportunity to start an online conversation themselves, which will potentially lead to an online or even offline «strawberry». But, it is clear that the absolute majority of all these «Telegram activities» lead only to depriving a gullible client of funds, without offering almost nothing in return. After all, it is difficult to even imagine the volumes of already degenerated world porn content, which the admins of such channels and accounts can pass off as their own, exclusive, fresh and real. Not to mention the fact that it is now very easy for skilled people to create individual, completely realistic porn avatars using AI. Experts told us about this and other things.
The nature of the phenomenon. We want «bread and spectacles,» but we get a «funnel of deception»
All the experts we interviewed are unanimous in their conclusions — pornbots simply use inherent human weaknesses to achieve their own goals, in particular, they manipulate sexual interest.
«Spammers are simply adapting to Telegram, and the slogan „bread and spectacles“ still works to this day. And what spectacles are the most interesting? Sorry — tits, vaginas, and rods. This story has been unchanged for centuries. That is why they use the so-called „slutbots“ — in our semantic interpretation, these are bots that spam in order to drag a person to this or that Telegram channel, where they will demonstrate female charms to him,» explains white hacker Mykyta Knysh in a comment to dev.ua.
Cybersecurity & Emerging Tech Consultant Vyacheslav Davydenko states: thus, attackers actively use deception, social engineering, and exploitation of human weaknesses, in particular sexual interest, to create fake traffic and manipulation.
He claims that the basis of most such schemes is the so-called «deception funnel.» For example, users are promised exclusive content — «showers» of private photos or videos, «home archives» or even «gifts» — with one goal: to force them to subscribe to numerous channels or, more dangerously, to later enter their bank card details.
«The result is predictable: either a person finds himself in an endless chain of fake promises, switching from channel to channel in vain, or loses money and confidential data. Telegram has become a favorite tool of scammers due to the lack of centralized content control and the widespread, but false, perception of users about the absolute anonymity of the platform,» says Vyacheslav Davydenko.
Mykyta Knysh agrees with our assessments — such porn Telegram channels, where subscribers are offered explicit content for money, can be called a kind of «OnlyFans for the poor.» «Not everyone is ready to go to Only, have fun and write to a person there what you want from her. And going to Telegram and „for stars“ buying some „intimate things“ is probably a more popular story,» he says.
At the same time, according to Knysh, spamming in the same way can be done not only by «slutbots» — it can also be accounts from which messages are distributed, supposedly about finding employees or something. «So once again, this is not a new phenomenon, spammers have simply reoriented themselves from forums and chats to Telegram. That is, the place of concentration of people is changing — the forms and means of spam are also changing,» the expert explains.
Netpeak Group, whose specialists helped us to analyze this topic in detail, points out that messages from such bots in Telegram channels are nothing more than neurocomments. «These are automatic comments from bots written by artificial intelligence for posting in large, popular or niche Telegram channels,» Netpeak Group noted.
This phenomenon is called neurocommenting, and it began to gain popularity in the spring of 2023, when bots began to appear under posts, commenting instantly and on the topic of the post.
As Netpeak specialists point out, this is a very cheap way to promote on social networks with no or very low moderation.
«This is mass advertising that tries to get clicks or subscriptions using provocative images and comments. It works on the principle: attention → click → monetization/data extraction,» Netpeak Group explains.
Their goal is to attract attention and drive traffic to other channels or services, such as:
- Scams — under the guise of «girls nearby», they may offer to fill out a fake questionnaire that leaks data or signs up for paid services;
- Advertising adult content — promoting OnlyFans, porn sites, leading to real accounts, but often with fake media;
- Online prostitution/webcam — some of these accounts may belong to webcam agencies;
- Private initiative — sometimes it’s really people promoting themselves. But 90% of it is botnets.
Netpeak experts add that neurocommenters react very quickly to new posts, so they are not difficult to notice: they appear almost immediately after publication, most often in the first 60 seconds. And although they often write «on topic» to disguise themselves as real people, they can be identified by several common signs:
- uniformity;
- irrelevant or «mechanical» text;
- link in bio (the description of a bot account always includes a link with a call to join or order a service, because the main purpose of such comments is to drive traffic to this link).
What dangers does this pose?
Cybersecurity expert Vyacheslav Davydenko highlighted the following most common scenarios in his commentary to our publication.
Subscription in exchange for a «strawberry»
In his words, this is a «classic of the genre.» A bot disguised as a young girl’s profile promises intimate content. The condition is to subscribe to several channels. These channels can contain trash content, be tools for ripping off the audience, or simply be another porn channel. Of course, no one provides the promised exclusive, and the goal is one — to force you to subscribe, because the owners of these channels pay scammers for «live» (albeit misled) subscribers. Often, after the first wave of subscriptions, new, even more attractive offers begin according to the same scenario.
«Generous» money draw
You may be lured by promises of full versions of porn videos, again, for subscribing to a number of channels. On one of them, a message suddenly appears about an incredible money draw. To participate, you only need to enter your bank card details. The consequences are obvious — theft of funds or phishing, that is, transferring card details into the hands of criminals.
Exclusive chat or «husband filming wife»
This scheme, according to Vyacheslav Davydenko, is a gradual one. You are directed to channels that are supposedly hosted by real people (for example, a man sharing intimate moments with his wife, or a sex worker). The ultimate goal is to convince you to sign up for a paid subscription to «exclusive» content or pay to communicate in a private chat.
Casino advertising under the guise of «showers»
Sometimes, according to a cybersecurity specialist, bots simply generate traffic to certain sites. Often, the final stop in your pursuit of the promised content is intrusive advertising, for example, online casinos. Loud promises of «showers of compromising information» on famous personalities — politicians, bloggers, media personalities — are also often just an excuse to show advertising. Interestingly, such «showers» rarely contain specifics, relying on the victim’s imagination. There is zero real compromising information, instead you get endless scrolling of advertising and new subscription offers, claims Vyacheslav Davydenko.
He argues that the danger of this phenomenon should not be underestimated, because interacting with such bots or following their links is a direct path to serious cybersecurity problems.
«Every careless click can lead to financial losses due to fake „donations“ or fraudulent subscriptions, transferring bank card data to phishers, installing malware on your device, or even losing access to your Telegram account,» the expert says.
In this context, white hacker Mykyta Knysh once again reminds users of information hygiene and elementary logic. After all, it’s one thing if a Telegram user simply writes to a so-called whorebot in a «personal» message, and it offers to switch to a private channel. «There, as a rule, there are two or three „strawberry“ photos and videos, and it says: „Do you want me to do something for you?“ You write what you want. It sends you a video — the first time for free. And then — like, everything — then for money,» he says.
But, according to Nikita Knysh, there is another story that can end much worse for a user without critical thinking. «They hide some exe and ask to log in via Telegram. And here the rule works — don’t touch „what“. But with such success you could touch „what“ anywhere — on a porn site or a whorebot, it doesn’t matter. So in such cases, the risks for personal data are borne by the users themselves and their idiocy. We need to form critical thinking!», he urges.
As Netpeak Group specialists conclude, Telegram is a fairly popular platform for spam, so you should be very careful with any such bots, and it is better to avoid them.
Netpeak has identified several levels of risk:
Personal data — fake questionnaires, «verification», «18+ check» → leakage of phone, email, bank details.
Telegram account — if a user follows a link and enters a confirmation code on a fake website, the account can be stolen.
Financial losses — debiting funds from the card when trying to «access video» or «communicate.»
Blackmail is rare, but it happens based on correspondence or fake screenshots.
According to Cybersecurity & Emerging Tech Consultant Vyacheslav Davydenko, the mechanics of scammers’ earnings are quite simple: they either receive money from channel owners for boosting subscribers, or they directly steal money and data through phishing pages.
«Telegram, with its minimal moderation, the speed of deployment of fraudulent schemes, and an audience that easily responds to „free“ offers, has become an ideal environment for them. It is important to understand that these are no longer isolated cases, but the activities of organized teams that work according to proven templates,» he says.
According to Davydenko, this situation is part of a global trend: bots are increasingly displacing real users in the online space, and Telegram is no exception. Meanwhile, according to the expert, the share of automated activity that only imitates «live interaction» but is actually manipulative in nature is only growing every year.
How does it work technically and how much does it cost?
Netpeak Group notes: automated scripts or bots monitor posts in popular channels/chats or specific keywords (for example, «evening», «Kyiv»).
After a new post appears, the following algorithm occurs:
- The script immediately captures the message ID.
- Chooses a comment template. Often with an AI twist — short, on-topic, so as not to be filtered.
- Leaves a comment from an account with an attractive avatar and name.
- Can add emojis, tag the author, or attach links.
Sometimes they use AI-generated contextual comments to embed themselves in the discussion and appear «alive.» Analyzing the issue of costs, Netpeak specialists note that from a mass perspective, this is a very cheap and quick way to get clicks.
Account creation, according to them, costs <$0.05 per account or is free via Telegram API. Hosting and scripts also cost a pittance. AI/chatbots cost $5–20/month for the entire network, and the human time involved is also minimal.
«It’s many times cheaper than official advertising. And it’s very well suited to fraudulent schemes,» says Netpeak Group.
The mechanics of how such «spam machines» work are also shared by white hat hacker Mykyta Knysh. For example, he mentions automation services such as N8N or Knight.
«You go in, set up a certain sequence of actions. The bot is subscribed to many channels, it monitors them. It has a trigger, or the so-called script, according to which certain triggers are executed. If, conditionally, a new post appears, then you can set up automation in Knight. Or there is also a Chinese neuron that allows you to automate everything — Manus,» he says in a comment to dev.ua.
So, when a new post is published in the Telegram channel to which we are subscribed, then, according to Knysh, the automation selects the following sequence of actions: read the text, analyze what the text is about, and create a relevant comment in response. «I’m like, wow, you’re writing about a synchrophasotron??? The structure of a synchrophasotron is really very interesting! But even more interesting are my tits. This is a hypothetical example,» jokes Mykyta Knysh.
All of this, he says, is generated by the neuron in a certain sequence, and is configured literally in two or three clicks. «You can link your account, you can link a whole bunch of accounts so that it alternates them,» he adds.
Mykyta Knysh also claims that automating such a scheme costs a penny.
«Account costs — in Russia they sell them for 3-5 rubles. If in cents, it will cost 10 cents. From a hacked account, you load some data from the autoreg and send it out using neurons. That’s how it works technically,» he says.
At the same time, information about such technical nuances is also not too secretive, and if desired, according to him, the corresponding videos can be easily found on YouTube or TikTok.
«It will immediately give you a whole bunch of options on how to do it on neurons. If the neuron doesn’t want to do it, then there are good old spam programs like ZennoPoster. This is a program for automating certain actions, with which you can automate spam. You can also add Chat GPT to it, which would generate, for example, additional texts. And that’s it — you sit there, spamming,» — explained Mykyta Knysh, explaining the technical side of the matter.
How not to be fooled. Maximum caution and critical thinking
According to cybersecurity specialist Vyacheslav Davydenko, the promised «exclusive content» in such schemes almost never appears, and instead users receive a flood of spam, online casino advertising, phishing links, and endless exploitation of their trust and curiosity.
As he claims, the only way to protect yourself from such threats is to be extremely careful. «Do not click on dubious links or contact suspicious accounts. And most importantly, develop critical thinking. Remember: everything that is offered too attractively and for free almost always has its own hidden, and often dangerous, purpose. Be vigilant and protect your data!», — urges Vyacheslav Davydenko.
As convinced white hacker Mykyta Knysh says, many people are actually very far from understanding these realities, and such «slutbots» help them realize that many accounts on the Internet are bots, not people. «Although, as a rule, they are somewhat crookedly made and appear to be an adequate person «by eye». But they come to understand that a person simply cannot respond so quickly. If a post is A4 long, and a comment appears in a second, then a person cannot read an A4 page in a second. So they think: «Wow, this is probably some kind of robot,» he says.
Netpeak Group has formulated several basic recommendations for users to avoid losing their account or otherwise harming themselves:
- do not click on links offered by these bots;
- do not click on links that you are not sure about;
- do not enter any of your personal codes or passwords if these links offer this;
- Set up two-factor authentication, as well as set up email to protect your account, as this will help maintain access to your account.
However, as the company says, after the March update to Telegram, it has become much easier to understand who is writing to you.
In particular, it is possible to see the country based on the number, the date of registration, common groups, whether it is an official account, and whether the user has recently changed their name and avatar. «Therefore, with this information, it is much easier to understand whether it is spam or not,» Netpeak specifies.
Recommendations for channel administrators
If Telegram channel owners and admins strive for basic digital hygiene, then, again, Netpeak Group recommends that they review the channel’s subscribers and the group that serves as comments, and manually delete bots. After all, as a rule, these bots are already subscribed to you.
In addition, among other recommendations, enable the built-in spam filter. To do this, go to «Group Management» → «Administrators» → «Aggressive Antispam» in the settings.
Netpeak also recommends using Telemetrio to clean up your channel. However, disabling comments for a few days will give your channel/group a chance to be removed from the potential spam list.
Also, as experts note, with the help of special bots, it is possible to set a mandatory condition for subscribing to a group in order to comment. «This will stop some attacks, other bots can be quickly detected and blocked,» Netpeak Group adds.
Another life hack in this fight is to add the @LyAdminBot bot to the group and set it to automatically block. «A developer from Ukraine created moderation based on LLM. Random bans are possible, but special rules can be set,» Netpeak explained.
There are also other bots for moderating groups, such as:
At the same time, experts emphasize that you need to carefully choose the rights that you yourself grant to the bot. «Neurocomments are a new type of spam, and it must be fought systematically. Constant monitoring, a combination of technical means and organizational measures effectively reduce their impact. Taken together, such solutions will help protect the Telegram channel from „neurospam“ and maintain the purity of comments,» the Netpeak Group summarizes.
This post was originally published on this site be sure to check out more of their content.
