Anti-Raid Defense

What Is a Raid and Why It Matters

A raid is a coordinated attack on a Telegram group where a large number of malicious users join simultaneously and flood the chat with spam, offensive content, or disruptive messages. Raids can happen to any group, but they are especially common against communities that discuss controversial topics, compete with other groups, or have high visibility. The damage from a raid can be severe: genuine members leave in frustration, the group's reputation suffers, and admins spend hours cleaning up the mess and banning offenders. In the worst cases, Telegram may temporarily restrict the group due to mass reports from the raiders.

The challenge with raids is speed. A coordinated raid can send hundreds of messages in the first minute, far faster than any admin team can react. By the time you start banning individual users, the damage is already done. BotWave's anti-raid system addresses this by detecting the attack pattern automatically and taking immediate protective action, without waiting for an admin to notice and respond.

Automatic Raid Detection

The auto-raid module monitors join patterns in real time. When an unusual surge of new members is detected — more joins than normal within a short time window — the bot automatically activates raid mode. In raid mode, all new members who joined during the suspicious period are restricted from posting, and any new joins are immediately muted pending verification. The detection parameters are configurable: you set the join rate threshold with /raidtime and the action duration with /raidactiontime.

The automatic detection means your group is protected even when no admins are online. A raid at 3 AM is handled the same way as a raid at 3 PM. Once the raid subsides and no new suspicious joins are detected for the configured period, raid mode deactivates automatically and normal operations resume. The /autoantiraid command toggles this automatic detection on or off, and /antiraidconfig shows the current configuration.

Manual Raid Mode

Not all raids are detected by automatic patterns. Sometimes you receive advance warning — perhaps another group has announced an attack, or you notice suspicious activity that has not yet triggered the automatic threshold. In these cases, you can manually activate raid mode with /antiraid on. This immediately restricts all new joins and prevents posting from recently joined members, giving you time to assess the situation and take targeted action.

Manual raid mode stays active until you turn it off with /antiraid off, giving you full control over when the protective measures are lifted. This is useful when you want to maintain heightened security during a known threat period, even if the automatic detection would have already deactivated. Combining manual and automatic modes gives you both proactive control and reactive protection.

Federation: Bans That Propagate

When a malicious user is banned from one group, they often simply move to another group in the same community and continue their behavior. The federation system solves this by propagating bans across all linked groups. When you ban a user with /fban, that ban is automatically applied to every group in your federation. The user cannot simply hop to another group — they are removed from all of them simultaneously.

Creating a federation is straightforward: /newfed creates a new federation with you as the owner. Other groups can join with /joinfed using your federation ID. Federation admins can be promoted with /fedpromote and demoted with /feddemote. The /fedinfo command shows the federation status, including all linked groups and the number of federated bans. Federation data can be exported and imported for backup purposes, and the federation can be transferred to a new owner if needed.

The Shield Network

Beyond individual federations, the Shield Network enables cross-federation trust sharing. When a group subscribes to another federation with /subfed, bans from that federation are also applied to the subscribing group. This creates a network of shared trust intelligence where a ban in one federation propagates to all subscribing groups, dramatically increasing the reach of each ban.

The Shield Network is particularly powerful for communities that share common interests and face common threats. A network of crypto groups can share bans of known scammers. A network of gaming communities can share bans of known cheaters. The network effect means that each new group that joins the Shield Network increases the protection for all existing members. The /fedsubs command shows all federation subscriptions, and /myfeds shows which federations your groups are linked to.

Join Filters and Pre-Entry Screening

The best defense against raids is preventing raiders from entering in the first place. The join filter system screens every new member against configurable criteria before they are allowed to join. You can require new members to have a profile photo, a username, a minimum trust score, or a name that does not contain flagged words. The /joinfilter command toggles the filter, and /joinmode sets whether to approve or block members who fail the criteria.

The join rate limit adds another layer of protection by capping how many new members can join per time period. If the limit is exceeded, additional joins are queued or blocked, preventing the sudden surge that characterizes a raid. Combined with captcha verification and the entry gate system, join filters create a multi-layered defense that stops most raids before they begin.

Available Commands