Telegram Group Guard — Administrator & User Guide

Stormhood Group Guard is an autonomous, multi-layered security bot for Telegram communities. Unlike legacy bots that rely strictly on static keyword matching, Stormhood combines ultra-low-latency rule-based pre-filters with context-aware LLMs and Vision AI to eliminate scams, phishing, spam raids, and channel impersonation.

1. Quick Start (30-Second Onboarding)

Add Stormhood to your Group:
- Add @stormhood_bot to your Telegram public group or supergroup.
Promote to Administrator:
- For full autonomous moderation, grant the following permissions:
  - 🗑️ Delete messages (required to purge phishing links, scam posts, and noise).
  - 🚫 Ban users (required to remove confirmed malicious actors and fake channels).
  - ⏱️ Restrict / Mute members (required for the anti-flood gatekeeper and CAPTCHA).
Verify Protection:
- Send /groupstatus in your chat. The bot will report active shields, daily quota, and provide a direct link to the Telegram Mini App dashboard.

2. Multi-Layer Security Architecture

Stormhood operates a sequential 6-tier defense matrix designed to protect group performance and preserve AI scan quotas:

Incoming Telegram Message
          │
          ├──► [Tier 1] Service Message Cleaner (Purges "Joined" / "Left" noise)
          │
          ├──► [Tier 2] Pre-LLM Anti-Flood & Raid Gatekeeper (3 msgs / 5s → 15m mute)
          │
          ├──► [Tier 3] Anti-Bot Join CAPTCHA (Interactive button verification)
          │
          ├──► [Tier 4] Channel Impersonation Shield (Bans external spoofed channels)
          │
          ├──► [Tier 5] Context-Aware AI & Vision Threat Engine (Zero-day links, OCR)
          │
          └──► [Tier 6] Graduated Sanctions Ladder (1h mute → 24h mute → permanent ban)

Layer 1: Service Message Auto-Cleanup

What it does: Silently deletes "User joined the group" and "User left the group" service messages.
Why it matters: Eliminates chat clutter and prevents join/leave spam during automated bot raids.

Layer 2: Pre-LLM Anti-Flood & Raid Gatekeeper

Threshold: 3 messages per 5 seconds per sender.
Sanction: On the 4th message within the window, the message is deleted and the sender is muted for 15 minutes.
Performance: Ultra-fast in-memory sliding window operating locally before external API calls.
Cost & Quota Protection: Handled locally before any LLM API call is triggered, protecting community owners against token exhaustion attacks.

Layer 3: Anti-Bot Join CAPTCHA Gatekeeper

What it does: When a new member joins, they are muted until they click the interactive "I am human" button within 60 seconds.
Why it matters: Blocks automated userbot swarms from entering and spamming the chat.

Layer 4: Channel Impersonation ("Send as Channel") Defense

What it does: Scammers frequently post malicious links using Telegram's "Send as Channel" feature to evade user-level bans.
How Stormhood defends:
- Scans message.sender_chat even when Telegram flags from.is_bot: true.
- Legitimate group admins and linked discussion channels are preserved.
- External fraudulent channels posting scam content are permanently banned via banChatSenderChat.

Layer 5: Context-Aware AI Threat Engine

Parses full message context and inspects links against real-time URL reputation and AI threat classifiers.
Detects zero-day scams that static regex filters miss (e.g. "Claim your exclusive airdrop now at sync-wallet-portal.app").

Layer 6: Graduated Sanctions Ladder

Minor offenses: 1-hour mute.
Repeated spam: 24-hour mute.
Malicious phishing / drainers: Immediate permanent ban and message deletion.

3. Administrator Commands

Command	Permission	Description
`/groupstatus`	Group Admin	Displays active shields, current plan, and scan quota remaining.
`/setalertmode`	Group Admin	Change alert mode for threat notifications.
`/upgrade`	Group Admin	Upgrade group protection plan.

Personal Protection: For forwarding suspicious private DMs, screenshot threat scanning, and account linking via the Telegram Mini App, see the Personal Telegram AI Bot & Mini App Guide.