A spammer passed CAPTCHA: diagnose the gap and fix the right rule
Investigate spam after a successful CAPTCHA, check the real admission path, choose a targeted message rule, and test false positives and recovery.
Your Telegram group has CAPTCHA enabled, yet a newcomer posts an advertisement. Before replacing the button with a harder puzzle, establish what happened. Was the challenge never shown? Did the account complete it? Or did the message come from someone who was already a member before verification was enabled?
Those are different problems. A missing check calls for an admission-flow repair. An unwanted message after a successful check calls for a content rule or a moderator’s decision. Passing CAPTCHA does not establish good intentions or give an account permanent permission to advertise.
Build a timeline for one incident
Start with the actual message. If it puts members at risk, remove it and contain the author under your community’s rules before completing the investigation. Keep only the evidence you need, such as the time, an available event link and a redacted example. Do not repost a dangerous link to the whole group for discussion.
Reconstruct the sequence: join or application, challenge, outcome, unwanted message, moderator response. Use available moderation-log records if the relevant categories were already enabled. Selected-event logging is not a complete account history. A missing record may mean an event category was not recorded; it does not prove that the account bypassed verification.
| What you can establish | What to inspect next |
|---|---|
| No challenge appeared | Group selection, CAPTCHA mode, actual entry route and bot permissions |
| The challenge was completed before spam appeared | The rule for that message, link or forward |
| The author was already a member | Current message rules and ordinary moderation |
| An unsuccessful applicant still gained access | Failure outcome, restriction duration and manual approval |
| Legitimate applicants are failing | Instructions, time allowance, attempts and access to help |
An account’s name, profile picture or response speed does not establish how a particular incident happened. A person can complete a challenge and then post spam. You do not need to prove automation before enforcing a clear rule against an unwanted message.
Worked example: an open-source study group
Consider a hypothetical study group whose members share documentation, code examples and project channels. A new account passes verification, posts a harmless introduction, then advertises an unrelated paid service through a Telegram channel link.
Available records confirm that the challenge was completed. The immediate gap is elsewhere: every Telegram channel link is permitted, although the published community rules prohibit unsolicited commercial promotion.
The administrator makes one targeted change. They add the observed promotional source to the blocklist, check the handling of channels and chats, and keep ordinary documentation websites available. In a test group, they reproduce the link rule with a safe controlled source, then try an approved project channel and a useful documentation link. If all three disappear, the new rule needs work.
A source-specific blocklist does not promise to catch every future advertisement from a new address. It closes the observed case. If sources keep changing, the team can reconsider the broader link policy, recurring text patterns and manual review without pretending that a harder CAPTCHA would have solved this incident.
If no challenge was issued, repair admission first
Open Settings in your private chat with @defendy_bot, select the correct group under My groups, and open CAPTCHA. Check that it is enabled, that the mode matches the invitation, and that the values were saved. Reopen the section after a connection error rather than relying on a switch’s last visible position.
In group challenges follow an ordinary join. Join requests challenges arrive privately while an application is pending. In the latter flow, success approves the request and failure rejects it. In the former, failure uses the configured kick, mute or ban. Configure the invitation route in Telegram separately from the Defendy mode.
Ask whether another administrator approved the request. Defendy does not issue a second in-group challenge after an approved application. Also test administrator-added members and returning members separately from someone joining independently for the first time. They are not interchangeable test cases.
Join-request processing requires permission to invite users; restrictions and message deletion need the appropriate rights for those actions. Correct the missing permission, then repeat the CAPTCHA setup test with a new ordinary member. Do not increase the penalty for newcomer mistakes while the admission path is still unverified.
If the account passed, choose a rule for the message
Use the evidence to pick one primary control in the group’s Mini App settings. Enabling every strict setting at once makes both diagnosis and rollback harder.
A known destination is the problem
Under Anti-spam → Links, websites and Telegram channels/chats have separate policies. You can block the relevant category, use a blocklist, or leave it unchanged. For a community that depends on useful links, start with the observed unwanted source. A broader restriction needs tested exceptions before it goes live.
Open the appropriate list, add the correct entry type and save the form. Test the format used in the incident: a bare address, a text link or another representation. Do not assume that a list guarantees recognition of every disguise or redirect. The link-filter guide explains the controls.
A distinctive promotional phrase keeps recurring
Under Stopwords, add a carefully chosen phrase to a list and check the matching mode: exact, partial or custom. A broad fragment such as “ad” can catch ordinary words such as “address.” A generic term such as “job” may remove legitimate career discussion in a professional community.
Defendy’s search mode applies at group level, while actions are configured per list. If you change the search mode for a new rule, retest existing lists too. Custom mode has its own condition and wildcard syntax; it is not an unrestricted regular-expression field. See the stop-word guide.
Neither the address nor the wording is stable
Review Anti-spam → Text, including whether it is enabled, its strictness and the selected action. Use actual missed-spam examples alongside ordinary messages from your community. A strictness change should be tested against both sets.
Adding the bot does not by itself demonstrate that all the rules you need are active. Additional checks have their own availability and conditions; resolving one incident does not require introducing a more complex system first. Start with the documented text anti-spam settings.
Decide separately about the message and its author
Should the message remain visible? What should happen to the person who posted it? Those decisions depend on your rules and the context. An obvious dangerous promotion may justify immediate containment. A member’s questionable but relevant recommendation deserves closer review before an indefinite ban.
For an automated rule, inspect message deletion separately from the user action. Choosing None as the punishment does not mean deletion is off. A warning also has consequences: its weight adds to an existing counter and may reach an already configured restriction threshold. Review the warning thresholds, actions and reset period before using warnings as a supposedly harmless trial.
After changing a mute or ban, recheck the duration. Where an indefinite action is supported, zero does not mean that the action is disabled. This is especially important after an urgent settings change.
Test the repair against useful messages, too
Use a test group and ordinary member accounts. The following is a moderator-run test process, not a built-in Defendy simulation feature.
- The known violation: send a safe, redacted version of the missed message. Replace dangerous destinations with a controlled test address temporarily included in the relevant rule.
- A useful link: try documentation, an event resource or another link that members should be able to share.
- Similar harmless wording: send a normal message containing the general words used in the spam example.
- The consequences: inspect deletion, warning points and restrictions, as applicable to the actions you selected.
- The recovery: verify that a moderator can identify the triggering rule and reverse a mistaken restriction.
Write down the expected result before each test. Deciding what should count as success after a useful message disappears makes the test meaningless. After rollout, review actual missed messages and member complaints as well as triggers. A high deletion count alone says little about rule quality.
For an example pair, an unsolicited promotion to an unrelated paid group should receive the community’s configured response. A member linking to official project documentation while answering a question should remain able to contribute. If the rule cannot distinguish the cases your policy distinguishes, narrow it or leave the ambiguous decision to a moderator.
When unwanted joins arrive in a wave
Assign immediate human responsibilities: one person watches admission, another handles harmful messages, and someone answers legitimate members. If necessary, temporarily change the available admission settings in Telegram and test the new route with an ordinary account. Record the change and the conditions for returning to normal.
Do not rely on a separate automatic CAPTCHA attack mode: the current Defendy documentation marks it as planned. Ordinary CAPTCHA, message filters and human incident handling remain separate parts of the response.
A team should also know who can reverse an emergency change. Leaving a temporary restriction in place without an owner can quietly prevent normal people from joining after the incident is over.
If your new rule catches a legitimate member
Disable or narrow the specific rule that caused the mistake. Then inspect the member’s state and reverse the incorrect warning, mute or ban using the appropriate moderation commands. Turning off a filter does not undo consequences it already applied.
Explain which rule triggered and what was corrected. After restoring access, test an ordinary message. Restoring posting rights does not restore deleted text, so do not promise automatic content recovery.
The incident is resolved when you understand the cause, the known test receives the expected response, useful messages pass, and moderators can correct mistakes. Increasing CAPTCHA difficulty is only one possible change. For abuse after a completed challenge, it may not address the observed problem at all.
Sources and scope
Checked on October 5, 2026 against Defendy’s documentation and implementation. The study group and message examples are hypothetical, not customer results. The Telegram Bot API defines join requests and their permissions. Rose’s maintainers separately document CAPTCHA, content restrictions and blocklists in their anti-spam guide, a useful separation of tasks rather than a feature list for Defendy.
