Behavioral Rotator · TG:ON Journal

⎯ TL;DR

Human behavior is statistically not uniform. Live users follow a log-normal distribution, bots follow uniform. That's the core difference anti-spam keys on.
Three dimensions: session entropy (session durations), swipe patterns (scroll trajectory), pause entropy (delays between actions).
Plus rotating fingerprint — stable per-account, different across accounts. Models the real population of Telegram users.
Math: log-normal for durations, bezier curves + micro-jitter for trajectories, Poisson for discrete events.
Implementation needs care: one mistake (uniform where log-normal should be) and the whole model is exposed.

Most anti-detection solutions for Telegram outreach stop at "add random delays". In 2022 that was enough. Today SpamBot looks at the distribution of delays and distinguishes `random.uniform(30, 60)` from a live user within 20-30 attempts.

To pass behavioral detection in 2026, you don't just need to "randomize" — you need to correctly model human behavior against the distributions observed in the real population.

01 · Session entropy

Dimension 1: session durations

How many minutes does a live user sit in Telegram per login? It depends on the type of action:

Quick check: 30-90 seconds (see if there are messages)
Medium session: 5-15 min (reply, skim the feed)
Long session: 30-120 min (active chat, voice call)

The distribution is not normal (as many assume). It's log-normal — symmetric in log-space, but skewed in linear space:

import numpy as np
import matplotlib.pyplot as plt

# Human session parameters, from empirical observation:
mu = np.log(600)       # median ~600 seconds (10 min)
sigma = 0.9            # wide spread

# Generate 10,000 "sessions"
sessions = np.random.lognormal(mu, sigma, 10000)

# Distribution: lots of short, rare very long ones
# Median: ~600s. Mean: ~900s (pulled up by the long tail)
# P99: ~4000s (~67 min)
        

Key point: you can't use a normal distribution — live users have a long tail of long sessions. You also can't use uniform — live users have no clean upper bound.

Sanity check: if your "sessions" are all between 2 and 20 min with no occasional 2-hour outliers — that's not a human, that's a script with random.uniform(120, 1200).

02 · Swipe patterns

Dimension 2: scroll trajectory

When a user scrolls the chat list, their finger (or cursor) doesn't move in a straight line. A finger has:

Acceleration at the start (overcome inertia)
Deceleration at the end (precision landing)
Micro-jitter along X (lateral random motion)
Easing curve — S-shaped, not linear

Mathematically — a bezier curve with two control points plus random jitter:

def human_swipe(start_y, end_y, duration_ms=500):
    # Bezier P0=(0, start_y), P3=(1, end_y)
    # Control P1, P2 — for the S-curve
    p1_t, p1_y = 0.25, start_y + (end_y - start_y) * 0.15
    p2_t, p2_y = 0.75, start_y + (end_y - start_y) * 0.85

    points = []
    for frame in range(int(duration_ms / 16)):
        t = frame / (duration_ms / 16)
        y = bezier(t, start_y, p1_y, p2_y, end_y)
        # Micro-jitter along X
        x_jitter = np.random.normal(0, 2)  # std=2px
        points.append((200 + x_jitter, y))
    return points

# Bot with random.uniform: straight line, visible within 3 swipes
# Live human: S-curve with X-axis jitter, like ours
        

In the Telegram Desktop / Mobile context — this applies to chat-list scroll speed, to delays between replies in a conversation, to "enter/return" navigation.

"Humans have finger jitter. Bots don't. It's one of the simplest signals for detection."

03 · Pause entropy

Dimension 3: delays between actions

Between the moment a user opens a dialog and sends a message, 5-30 seconds usually pass: read → think → type → send. A bot: 100-500ms (just the script's execution phase).

The distribution of these delays is a key signal. What matters: pauses depend on context:

Context	Median pause (live)	Typical bot
Response to an incoming message	20-60s	<1s
Between own messages (in one dialog)	30-120s	fixed delay
Between different targets in outreach	60-600s (log-normal)	uniform
Typing indicator → message sent	1-4s	0 or missing

Critical observation: across different contexts, pauses don't correlate for live users, and do correlate for bots (same scheduler under the hood).

04 · Rotating fingerprint

Dimension 4: device diversity

The fourth dimension isn't "temporal" but "categorical". Every Telegram session carries metadata: device_model, app_version, system_version, lang_code.

In the real population of 950M+ Telegram users these values are distributed: ~50% on iPhone, ~40% on Android, ~10% desktop. Within iPhone — different models (13, 14, 15, SE), different iOS versions. Same diversification on Android.

The "same Samsung Galaxy S24 for all 50 accounts" scheme is a clear farm signal. The correct scheme is sampling from a realistic distribution:

device_distribution = [
    ("iPhone 14", 0.08),
    ("iPhone 15", 0.12),
    ("iPhone 15 Pro", 0.09),
    ("Samsung Galaxy S23", 0.07),
    ("Samsung Galaxy S24", 0.06),
    ("Xiaomi Redmi Note 12", 0.05),
    # ... etc. ~50 models
]

def assign_fingerprint(account_id):
    # Deterministic — same device always for a given account_id
    # (so the fingerprint doesn't drift between sessions)
    np.random.seed(hash(account_id))
    return weighted_choice(device_distribution)
        

Important: fingerprint is stable for an account. A user doesn't change phones every day. Randomizing between sessions is a farm signal.

05 · Combined model

All together

Behavioral Rotator combines all 4 dimensions in a single model:

Session entropy — log-normal distribution for durations
Swipe patterns — bezier curves with micro-jitter for trajectories
Pause entropy — context-aware delays with different distributions
Rotating fingerprint — sampling from a realistic population, stable per-account

All of these models run in parallel. Session lasts this long → sample from log-normal. Inside the session, actions with these pauses → context-aware. Scrolling renders with bezier easing. Fingerprint stable.

Result: statistically, account behavior is indistinguishable from a live Telegram user at the level of aggregated signals. SpamBot doesn't see a pattern — not because "we hid it", but because there isn't one.

⎯ tech → product

All of this is already in TG:ON.
No coding.

Behavioral Rotator isn't open tech or an "API" — it's a built-in engine inside TG:ON. 3-day trial — run it on your own accounts and see 0 bans.

Start trial

Dimension 1: session durations

Dimension 2: scroll trajectory

Dimension 3: delays between actions

Dimension 4: device diversity

All together

TG:ON for macOS · Windows · Linux

All of this is already in TG:ON.No coding.

All of this is already in TG:ON.
No coding.