Wire fingerprints presented by traffic claiming to be TelegramBot, grouped by whether its source IP matches Telegram's published network ranges. Telegram publishes an address list on its developer site, without stating that it covers every link-preview fetcher address. It documents no User-Agent for link previews; the one tracked here is the string Telegram's own network sends. Membership confirms operator origin; a miss alone leaves the claim unverified.
Claims in window
Same adjudication as the stats page, under this operator's published channel: a claim from inside the network the operator publishes as its own is verified — consistent with operator origin; one from outside is unverified — inconsistent with the published network, but not a confirmed fake, because the operator does not state that set is exhaustive fetcher egress. A claim from inside a different operator's published crawler range is a strong impersonation signal. Sources count distinct clients, not traffic. Fingerprint windows below are day-granular, like sources.
observations
sources
verified
unverified
unverified rate
1
1
1
0
0.0%
Fingerprints presented by confirmed traffic
The highest-volume fingerprints the operator's own traffic runs, per signal — claims confirmed via operator-published channels (here: membership of the operator's published network). A Match pill marks an exact match against a controlled capture — an association with known stacks, not an identity verdict: unrelated clients built on the same stack can legitimately share a fingerprint.