Files

baradok609hecl1pq6qi da24c2bd20 reverse-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:17:15 +03:00

18 KiB

Raw Blame History

DarkTelegram.pro — Reverse Engineering Report (Public Assets Only)

Status: All claims are extracted from publicly served JS bundles (darktelegram.pro over plain HTTPS). No auth, no credentials, no mutating requests. Every endpoint name below is from minified frontend code, not from live API calls. Date: 2026-09-15 Rate limit: ~20 GET requests total (landing page, main bundles, module chunks, CSS). No fuzzing, no crawling.

1. Code-Split Chunk Filenames → Product Module Mapping

Chunks are Vite code-split .js files served from https://darktelegram.pro/assets/. The main entry index-CQKpAuC4.js (663 KB) declares the full dependency graph via __vite__mapDeps. The dashboard shell is App-DL7CzC9q.js.

Landing / Public Route Pages

Chunk	Module / Page
`index-CQKpAuC4.js`	SPA entry, route definitions, core API helpers
`App-DL7CzC9q.js`	Dashboard shell, sidebar, account picker, folder UI, context providers, full dependency map of all 80+ dashboard tab chunks
`Landing-CXQemKrJ.js`	Landing page hero
`AuthPage-CiVnbMr6.js`	Login/Register forms, OAuth, Turnstile (auth-independent header/footer CSS)
`AuthPage-rwu218-r.js`	Auth page shared logic
`ResetPasswordPage-CUxx1NKP.js`	Password reset
`SeoLayout-DI8Ngi0U.js`	SEO layout wrapper
`SeoMeta-Df7W64jI.js`	Dynamic SEO meta injection
`pageMeta-C24qRuxo.js`	Per-page SEO metadata config
`PrivacyPage-BUTds85K.js`	Privacy policy
`TermsPage-CDKHvBhR.js`	Terms of service

Product/Marketing Landing Pages (Feature Docs)

Chunk	Product Module
`TelegramManager--WBuvWjE.js`	Telegram Account Manager feature page
`AiBroadcast-CtQ819br.js`	AI Mailing feature page (3 modes)
`AiPromoter-OKyXD7VX.js`	AI Promoter / Нейродиалоги feature page
`BuyAccounts-BE-VUlUn.js`	Buy Telegram Accounts marketplace page
`Nakrutka-CmIdulPO.js`	SMM Panel / Накрутка (subscriptions, reactions, views)
`Arbitrage-D8HyljyM.js`	Traffic arbitrage page (dating/betting/crypto)
`AiAssistantsPage-BYjQpdtd.js`	AI Assistants page
`ParseReportPage-Tt5DVO47.js`	Parse report page
`BlogIndex-vXaavkcO.js`	Blog index
`BlogArticle-DkAe3e6J.js`	Blog article
`article-ChKm0xiJ.js`	Blog article (alternate)
`blog-refresh-CDwEFsgE.js`	Blog refresh component
`Converter-C77A1IiI.js`	tdata session converter
`TgStatParser-DtrLk5fl.js`	TgStat Chrome extension parser
`LztTrust-DT9wFtsT.js`	LZT Trust page
`JoinCabinetPage-ChqIw2TJ.js`	Join cabinet page
`kak-nachat-rabotu-v-darktelegram-D-RibygM.js`	How to start article

Dashboard Tab Components (authenticated code-split chunks)

Revealed from the sidebar route map in App-DL7CzC9q.js:

Route	Chunk (when applicable)	Module
`/accounts`	— (in main shell)	Account management
`/proxies`	— (in main shell)	Proxy management
`/market`	MarketTab	LZT Marketplace
`/warmup`	WarmupTab	Account warmup
`/broadcast`	BroadcastTab	AI Broadcast (8 modes)
`/chat-broadcast`	ChatBroadcastTab	Chat broadcast (AI DM broadcast)
`/autoreply`	AutoReplyTab	AI auto-reply
`/promoter`	PromoterTab	AI Promoter / AI sales agent
`/massreaction`	MassReactionTab	Mass reactions
`/nakrutka`	NakrutkaTab	Nakrutka (SMM panel)
`/masslooking`	MassLookingTab	Mass story viewing
`/story-mentions`	StoryMentionsTab	Story mentions
`/neurocommenting`	NeuroCommentingTab	Neuro-commenting
`/neuroshilling`	NeuroshillingTab	Neuro-shilling
`/inviter`	InviterTab	Inviter
`/salesman`	SalesmanTab	AI Sales Agent
`/copier`	CopierTab	Copier
`/audience`	AudienceTab	Channel management
`/groups`	GroupsTab	Group management
`/audience-parse`	AudienceParseTab	Audience parser
`/audience-users`	AudienceUsersTab	Audience user list
`/channel-db`	ChannelDbTab	Channel database
`/darkfather`	DarkFatherTab	DarkFather module
`/session-duplicator`	SessionDuplicatorTab	Session duplicator
`/telegram-folders`	TelegramFoldersTab	Telegram folders
`/links`	LinksTab	Links module
`/integrations`	IntegrationsTab	Integrations (MCP/API)
`/runpod`	RunPodTab	RunPod integration
`/products`	ProductsTab	Products
`/templates`	—	Templates
`/profile`	ProfileTab	User profile
`/wallet`	WalletTab	Wallet/balance
`/subscription`	SubscriptionTab	Subscription management
`/feature-logs`	FeatureLogsTab	Feature change logs
`/tasks`	TasksTab	Active tasks
`/referral`	ReferralTab	Referral program
`/support`	SupportTab	Support

2. Dashboard API Surface (Grouped by Module)

All endpoints inferred from fetch() calls in the public JS bundles. Relative to /api/. Returns { detail: ... } on errors.

Auth

Method	Path	Notes
POST	/api/auth/login	email + password login
POST	/api/auth/register	registration
POST	/api/auth/oauth/*	OAuth callbacks
POST	/api/auth/reset-password	password reset

Accounts

Method	Path	Notes
GET	/api/accounts	list
POST	/api/accounts	import
GET	/api/accounts/:id/export	export .session
GET	/api/accounts/:id/export-tdata	export tdata
PATCH	/api/accounts/:id	update
DELETE	/api/accounts/:id	remove
GET	/api/account-folders	list folders
POST	/api/account-folders	create folder
PATCH	/api/account-folders/:id	rename folder
DELETE	/api/account-folders/:id	delete folder

Proxies

Method	Path	Notes
GET	/api/proxy-folders	list proxy folders
POST	/api/proxy-folders	create folder
PATCH	/api/proxy-folders/:id	rename folder
DELETE	/api/proxy-folders/:id	delete folder

Broadcast (AI Mailing)

Method	Path	Notes
GET	/api/broadcast/history?page=N	paginated history
GET	/api/broadcast/status	campaign status
POST	/api/broadcast/create	create campaign
POST	/api/broadcast/:id/start	start campaign
POST	/api/broadcast/:id/stop	stop campaign
POST	/api/broadcast/:id/retry	retry failed
GET	/api/broadcast/:id/stats	campaign stats (funnel)
GET	/api/broadcast/:id/recipients	per-recipient report
GET	/api/broadcast/stream/:id	SSE log stream
GET	/api/broadcast/audience-count	audience count query
GET	/api/broadcast/smart/active	active Smart broadcasts
POST	/api/broadcast/smart/:id/pause	pause smart broadcast
POST	/api/broadcast/smart/:id/stop	stop smart broadcast
POST	/api/broadcast/voice	upload voice file
DELETE	/api/broadcast/voice/:id	delete voice file
GET	/api/broadcast/voice/:id/file?token=	stream voice file

Audience / Parser

Method	Path	Notes
GET	/api/audience-folders	audience folder list
GET	/api/groups-channel-folders	groups/channel folders
POST	/api/audience-parse/start	start parse task

AI Promoter / Нейродиалоги

Method	Path	Notes
GET	/api/promoter/status	promoter status
GET	/api/promoter/sessions	list past sessions
POST	/api/promoter/start	start session
POST	/api/promoter/stop/:id	stop session
POST	/api/promoter/demo	demo: test message vs product
GET	/api/promoter/stream/:id	SSE log stream
GET	/api/promoter/monitor-targets	list monitorable chats
POST	/api/promoter/preview-scenarios	generate scenario preview

Profile / User

Method	Path	Notes
GET	/api/profile/limits	user limits
GET	/api/profile/promoter-settings	promoter prompt templates
PUT	/api/profile/promoter-settings	update promoter prompts

Products

Method	Path	Notes
GET	/api/products	list products with keywords

3. AiPromoter (AI Sales Agent) Flow — Detailed

Based on PromoterTab-ClNavCxu.js (dashboard component) and AiPromoter-OKyXD7VX.js (marketing page).

Data Model

Product (from GET /api/products):

{
  id: number,
  name: string,
  keywords: string[],
  description?: string,
  link?: string
}

Session Config (POST /api/promoter/start):

{
  product_id: number,
  account_ids: number[],
  target_chats: string[],
  initial_history_count: number,
  dm_followup?: {
    enabled: boolean,
    min_delay: number,  // minutes
    max_delay: number   // minutes
  },
  hyperlink_enabled: boolean,
  mode: "polling" | "realtime",
  reaction_delay_min?: number,  // seconds
  reaction_delay_max?: number,
  autoreply_prompt_id?: number | null,
  solve_captcha: boolean  // BETA
}

3-Phase Flow (confirmed from bundle)

Phase 1 — First message to everyone:

AI writes to every contact in the base from the connected account
Message is contextualized using product description + keywords

Phase 2 — Qualification (criteria matching):

When someone responds, AI evaluates relevance via relevance_prompt:
- Variables: {keywords}, {description}, {message}
- Output: keywords_matched[], keywords_missed[], matched: boolean
If matched, generates public reply via comment_prompt:
- Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message}
If DM follow-up enabled, generates DM via dm_prompt:
- Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}

Phase 3 — Notification:

Sends Telegram notification via DarkTelegram bot to the user
Includes: contact name, what they want, product interest, full dialog history
Session log tracks: mentions (public), dm_replies (private), account_ids, product_name

Demo Endpoint

POST /api/promoter/demo Request: { message: string, product_id: number } Response: { matched, reply, dm_message, reasoning, keywords_matched[], keywords_missed[] }

Custom Prompts (saved via GET/PUT /api/profile/promoter-settings)

Three editable prompt templates:

relevance_prompt: {keywords}, {description}, {message}
comment_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message}
dm_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}

4. TelegramManager and AiBroadcast Endpoint Shapes

AiBroadcast (from BroadcastTab-B9lQ9vJz.js)

POST /api/broadcast/create body:

{
  name, account_ids[], broadcast_mode,
  audience_folder_ids[], audience_min_messages, audience_has_username,
  audience_search, audience_only_new,
  messages_per_hour, schedule_hour_min, schedule_hour_max,
  enable_ramp_up, enable_dialog_warmup, skip_read_contacted, send_greeting_sticker,
  followup_enabled?, followup_delay_hours?, followup_text?, followup_entities?,
  // mode-specific:
  message_text?, message_entities?, ai_uniquify?,
  warmup_duration_min?, warmup_duration_max?,
  greeting_prompt?, link_mode?, link_url?, link_text?, link_prompt?, // threephase
  reply_timeout_hours?, delay_after_reply_min?, delay_after_reply_max?, skip_autoreply?,
  postbot_text?,                                                      // postbot
  smart_mailing?, smart_daily_limit?, smart_min_interval_minutes?,     // smart
  contacts_include_dialogs?, contacts_quiet_mode?,                     // contacts
  voice_id?                                                            // voice
}

Campaign stats (GET /api/broadcast/:id/stats):

{
  funnel: { recipients, greetings_sent, replies, links_sent },
  stats: { sent, replied, link_sent, failed, peer_flood_count,
           peer_flood_accounts, by_status: { [status]: count } }
}

TelegramManager

The marketing page only (not a dashboard tab). Routes to /accounts. Capabilities: built-in marketplace, auto-proxy, 1-click warmup (95% survival), AI tools, audience parsing, real-time monitoring, session/tdata import, parallel execution.

5. Cloudflare Turnstile Wiring

Loaded via script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" in HTML head
Widget rendered into div.auth-turnstile (centered, min-height: 65px)
Token submitted alongside email/password in auth form POST body
Turnstile is NOT on API endpoints — only on auth pages
Gated: exact form field name (cf-turnstile-response by convention, not confirmed without auth form JS logic)

6. Feature-Gap Table: DarkTelegram.pro vs T-Pilot

Legend: ✅ Present | ⚠️ Partial | ❌ Missing

Core Infrastructure

Capability	DT	T-Pilot
Multi-account management	✅	✅
Proxy management + auto-rotation	✅ built-in pool	⚠️ user-provided only
Account import (.session / tdata)	✅ both	⚠️ converter exists
24/7 cloud execution	✅	⚠️ local-first
Embedded Telegram Web	✅ ($20)	❌
API/MCP integrations	✅	⚠️ partial
Auto-captcha solving (~85%)	✅	❌

Account Management

Capability	DT	T-Pilot
Marketplace (buy accounts)	✅	❌
Warmup	✅	✅
Trust Score	✅	✅
Session duplicator	✅	✅
Profile fill	✅	✅
Number checker	✅	✅
Chat creator	✅	✅
Dialog cleaner	✅	✅
Restrictions removal	✅	✅
AI Protection	✅	✅
Telegram folders sync	✅	❌
Cloner	✅	✅

Broadcasting

Capability	DT	T-Pilot
Single message broadcast	✅	⚠️ basic exists
Multi-phase (threephase)	✅	❌
PostBot broadcast	✅	❌
Smart broadcast	✅	❌
Sticker broadcast	✅	❌
TTL broadcast	✅	❌
Voice broadcast	✅	❌
Contacts broadcast	✅	❌
AI uniqueization	✅	⚠️ AIPostGenerator
Audience filters	✅	❌
Campaign stats/funnel	✅	❌
Per-recipient report	✅	❌
SSE live logs	✅	❌

AI / Sales

Capability	DT	T-Pilot
AI auto-reply	✅	✅
AI Promoter (Нейродиалоги)	✅ ($50)	❌
AI Sales Agent (SalesmanTab)	✅	❌
Neuro-commenting	✅	⚠️ basic
Neuro-shilling	✅	❌
AI Assistants	✅	⚠️ partial
Lead qualification	✅	❌
Scenario preview	✅	❌
Products with keywords	✅	❌
ROI Predictor	❌	✅ (TP differentiator)
Lead Catcher	❌	✅ (TP differentiator)

Audience / Parsing

Capability	DT	T-Pilot
Channel parser	✅	✅
Group parsing	✅	⚠️ forum_scraper.py
Audience users list	✅	❌
Channel database	✅	❌
TGStat parser	✅	❌
Audience filters	✅	❌

Capability	DT	T-Pilot
Mass reactions	✅	⚠️ basic
Mass story viewing	✅	❌
Story mentions	✅	⚠️ StoryTags
Nakrutka (SMM panel)	✅	❌
Inviter	✅	✅
Mass subscribe/unsubscribe	✅	✅
Boost	✅	✅
Username checker	✅	✅
Text randomizer	✅	✅

Business / Monetization

Capability	DT	T-Pilot
Products (for AI Promoter)	✅	❌
Templates	✅	❌
Referral program	✅	❌
Subscription tiers + modules	✅	❌ (open)
Wallet / balance	✅	❌
One-click setup	✅	❌
Support ticket system	✅	❌
Feature change logs	✅	❌

T-Pilot Differentiators (not in DT)

Capability	DT	T-Pilot
AI Post Generator	❌	✅
SEO Bot	❌	✅
Telegraph Poster	❌	✅
Email Sender	❌	✅
Traffic Generator	❌	✅
Forum Scraper	❌	✅
Blast Control	❌	✅
News Module	❌	✅

7. Prioritised Recommendations for T-Pilot

Cheapest-highest-value first.

Tier 1: Low Effort, High Value (1-2 days each)

Broadcast audience filters — Folders, min_messages, has_username. Reuse existing parser. ~1 day.
Campaign history + basic stats — Persist completed campaigns. T-Pilot tracks task state. ~1 day.
AI message uniqueization — Wrap existing AI to rewrite per recipient. ~1 day.

Tier 2: Medium Effort, High Value (2-4 days)

AI Promoter (Нейродиалоги) — Closes DT largest gap. Reuse NeuroChat/NeuroComment. ~3 days.
Multi-phase (threephase) broadcast — State machine on broadcasting.py. ~2 days.
SMART broadcast — Rate limiter + daily cap. ~1 day.

Tier 3: Higher Effort, Strategic (3-5 days)

Built-in account marketplace — Largest DT conversion driver. ~5 days.
Per-recipient campaign report — Chain viewer. ~2 days.
Auto-captcha solving — ML/heuristic for Telegram. ~3 days.

Tier 4: Differentiators (4-7 days)

Nakrutka — Subscriptions + reactions + views with own farm. ~3 days.
Embedded Telegram Web — WebK/Telethon mini-client. ~5 days.
Traffic arbitrage funnel — Pre-configured vertical scenarios. ~4 days.

Top 6 by Value

#	Feature	DT price	TP effort	Impact
1	Broadcast audience filters	bundled	1 day	Direct conversion
2	Campaign stats/funnel	bundled	1 day	User retention
3	AI uniqueization	bundled	1 day	Spam safety
4	AI Promoter	$50/mo	3 days	Closes biggest gap
5	Multi-phase broadcast	$20/mo	2 days	3-5x conversion
6	SMART broadcast	$20/mo	1 day	Stealth dispatch

Compliance Confirmation

No authentication attempt — all data from public HTTP(S) fetches of .js bundles
No mutating requests — GET only
No credentials or session tokens used or transmitted
No customer data scraped or enumerated
Rate limit observed — ~20 requests total
Gated resources noted as such
Turnstile token field name is gated (not in extracted CSS-only auth chunk)

18 KiB Raw Blame History