This page is about one way into a platform: joining its public groups, channels or servers and recording what happens inside them. Telegram channels selling stolen data, WhatsApp groups passing political rumours, Discord servers swapping jailbreak prompts — the object differs, the route is the same. You find an invite link or a directory entry, you enter as a member (or read a public channel without entering), and from then on the platform's own client shows you the messages, the member list and the media, up to whatever that platform chooses to expose.

It is a child of Platforms, which is organised by route in and covers APIs, research programmes, ad archives, scraping, sock puppets, data donation and access requests. Joining a group is none of those: it is not an API the platform built for you, not a programme you applied to, and not a public web page. It has its own discovery problem, its own denominator, its own tooling and bans, and an ethics problem the parent page does not have — the people whose messages you record joined a group, not a study. This page is about the route, not the three companies; where a company's current rules decide what you can do, they are dated and linked to the primary source, and the provenance page records every fetch.

Five papers, chosen because each shows a different part of the route rather than a different topic. All five are Telegram or WhatsApp; for Discord, start with [2Shen, Xinyue; Chen, Zeyuan; Backes, Michael; Shen, Yun; Zhang, Yang (2024): ""Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] (servers found through Disboard), and for the commoner case where group data is one source among several, [3Vu, Anh V.; Collier, Ben; Thomas, Daniel R.; Kristoff, John; Clayton, Richard; Hutchings, Alice (2025): "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services", in: Proceedings of the USENIX Security Symposium. (Link)] (booter channels as one of eight datasets, each cross-checked against the others).

• [1Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] (IMC 2020) — all three platforms side by side, and still the only paper here that compares them. Harvested 351,535 group URLs from 2,234,128 tweets over 38 days, then joined 616 WhatsApp, Telegram and Discord groups. Read it for the per-platform differences in what a joined member can see, for the join caps it measured, and for how much personal data a group exposes: “For WhatsApp, even without an account, we could collect an impressive number of over 34K phone numbers. Moreover, after joining groups, we obtain another 20K phone numbers.”
• [4Resende, Gustavo; Melo, Philipe F.; Sousa, Hugo; Messias, Johnnatan; Vasconcelos, Marisa; Almeida, Jussara M.; Benevenuto, Fabrício (2019): "(Mis)Information Dissemination in WhatsApp: Gathering, Analyzing and Countermeasures", in: Proceedings of the ACM Web Conference. (DOI)] (TheWebConf 2019) — WhatsApp monitoring with physical phones, the design the 2018–2021 WhatsApp literature shared. Searched Google, Twitter and Facebook for chat.whatsapp.com links, found 3,444, of which only 1,828 still worked, and joined 141 and 364 groups with cell phones for two Brazilian events. Read it for the attrition between “link found” and “group monitored”, and for its honest limitation: the number of groups “was constrained by the available devices and their resources (memory)”.
• [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] (USENIX Security 2026) — snowball discovery done carefully, at the largest scale here. 21k candidate channels from keyword search, cybercriminal forums and recurrent snowballing; roughly half examined; 1,521 joined, 448 of them private; about 14 million messages over a year. Read it for its joining rules — “We do not lie or pretend to be an interested buyer to be admitted into groups” — and for the check every channel study should copy: only 0.8% of its stolen-data channels appear in the large public Telegram datasets.
• [6Saha Roy, Sayak; Pourabbas Vafa, Elham; Khanmohamaddi, Kobra; Nilizadeh, Shirin (2025): "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] (USENIX Security 2025) — a directory as the seed, and the bias it states. Took 4,709 English channels with 10,000 or more followers from Telemetr.io, kept 339, and polled them every ten minutes through the official API. Read it for the bias sentence — “this approach might have introduced potential biases by omitting smaller or newly emerging channels” — and for disclosure as a measurable outcome, which came out two ways: of the 339 channels it had monitored and reported, “only 64 channels (19%) were removed”; of 196 new channels its classifier later found through links shared on Telegram and Facebook, reporting “led to the removal of all 196 channels, with a median response time of 4 days”.
• [7Kireev, Klim; Mykhno, Yevhen; Troncoso, Carmela; Overdorf, Rebekah (2025): "Characterizing and Detecting Propaganda-Spreading Accounts on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] (USENIX Security 2025) — a registered client, back-filled history, and an ethics section that answers the questions. A Telethon client “officially registered as such on the Telegram website”, Telegram's export-history call for the past (it “returned all messages from either the past 36 months or up to a limit”), real-time collection for the present, 17.3M messages from 13 hand-picked channels — and the plain admission that “given the small selection, we cannot make any statement about the pervasiveness of this propaganda activity in Telegram”.

A messenger's name in a methods section does not make a paper a group study. Of the 147 candidates sorted for this page, 105 were not about groups at all and 16 were about something adjacent. Sort yourself before you design:

Two rows deserve a sentence each. Chatbot ecosystems — listing Discord bots on top.gg and testing their permissions in guilds you built yourself [13Edu, Jide S.; Mulligan, Cliona; Pierazzi, Fabio; Polakis, Jason; Suarez-Tangil, Guillermo; Such, Jose M. (2022): "Exploring the security and privacy risks of chatbots in messaging services", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — measure the platform's app layer, not the groups; they need none of this page's discovery and none of its ethics. And scam-baiting over one-to-one chats [14Li, Xigao; Rahmati, Amir; Nikiforakis, Nick (2024): "Like, Comment, Get Scammed: Characterizing Comment Scams on Media Platforms", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] is a conversation with an adversary, not observation of a community; that paper entered exactly one Telegram group, when a scammer invited it in.

Nobody in these venues sampled groups from a list of all groups, because no such list exists outside the platform. Every study starts from a seed, and the seed decides what kind of group you can find. Hand-coded over the 26 papers that used this route (a paper can use several seeds):

Four things about seeds that the papers learned the hard way.

• A link is not a group. [4Resende, Gustavo; Melo, Philipe F.; Sousa, Hugo; Messias, Johnnatan; Vasconcelos, Marisa; Almeida, Jussara M.; Benevenuto, Fabrício (2019): "(Mis)Information Dissemination in WhatsApp: Gathering, Analyzing and Countermeasures", in: Proceedings of the ACM Web Conference. (DOI)] found 3,444 WhatsApp links and 1,828 worked; [23Weerasinghe, Janith; Flanigan, Bailey; Stein, Aviel J.; McCoy, Damon; Greenstadt, Rachel (2020): "The Pod People: Understanding Manipulation of Social Media Popularity via Reciprocity Abuse", in: Proceedings of the ACM Web Conference. (DOI)] collected 38,000 group URLs over three snowball iterations; a classifier kept 4,425 as pod-related, 873 of those were currently active public Telegram groups, and 432 of those were the engagement “pods” it studied. [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] examined roughly half of its 21k candidates. Report every stage of that funnel, not the last number.
• Expiry shapes a link harvest. [1Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] found more Discord URLs than WhatsApp or Telegram ones “presumably owing to Discord group URLs automatically expiring after a day”, so users re-posted fresh links. That was 2020. Discord's own help page now says an invite shows “a 7 days access link by default”, and in Community servers an invite can be set never to expire¹⁾. A 2020 link-volume comparison across platforms does not carry over to 2026.
• Directories have entry rules. Discord's own Server Discovery lists only servers with “at least 1,000 members” that are at least eight weeks old²⁾; Disboard orders listings by how recently the owner bumped them; TGStat claims “More than 2 864 885 channels and groups” and its own country tiles put about 1.69 million of the channels in Russia³⁾. A directory is a sampling frame with a language skew and a popularity floor; name it and give its threshold.
• In-app search was edited under you. On 23 September 2024 Telegram announced that moderators had cleaned up search: “All the problematic content we identified in Search is no longer accessible”⁴⁾. A keyword-search seed for abusive content run before and after that date is sampling two different search engines. Telegram's recommendation call is also capped: by default it returns at most 10 similar channels to a non-Premium account⁵⁾, which bounds any snowball built on it.

Entering is where this route stops looking like scraping. What you can record depends on the platform, the group type, and — for member lists — on a setting the group's admin chose.

Across the 26 papers, 11 say they joined as members, 6 say they read public channels without saying whether they joined, 2 bought the data from a commercial scraper service, 1 received it from a vendor, and 6 do not say how they got in — two of those describe their channels as open to the public, which is a property of the channel, not a statement of what the researchers did. Only 8 say whether they back-filled history — 7 did, and [1Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] did on two platforms of three. That silence matters, because a study that joined in March and one that back-filled to the group's creation have different time windows for the same group.

Three consequences for a design.

• On WhatsApp, the observation window starts when you join. You cannot measure a group's past, and anything that happened before your join date is invisible — which is why the WhatsApp studies here are event-driven designs that joined before the event ([4Resende, Gustavo; Melo, Philipe F.; Sousa, Hugo; Messias, Johnnatan; Vasconcelos, Marisa; Almeida, Jussara M.; Benevenuto, Fabrício (2019): "(Mis)Information Dissemination in WhatsApp: Gathering, Analyzing and Countermeasures", in: Proceedings of the ACM Web Conference. (DOI)]: a strike and an election campaign).
• Public-channel reading is not group membership. A Telegram channel is a broadcast; a group is a conversation, and a channel's comment thread is a linked group. [7Kireev, Klim; Mykhno, Yevhen; Troncoso, Carmela; Overdorf, Rebekah (2025): "Characterizing and Detecting Propaganda-Spreading Accounts on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)]'s accounts joined the comment groups to receive their events, and “never interacted with the channels”. Say which object you recorded: channel posts, comment threads, or group messages.
• Your own account is part of the instrument. Scale on WhatsApp meant hardware: [1Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] noted the cap “translates to a need for hundreds of phones and SIM cards to join all discovered groups”. On Telegram each phone number can have one api_id, and Telegram says “all accounts that log in using unofficial Telegram API clients are automatically put under observation”⁹⁾. Plan the accounts, the numbers and what happens if one is banned before you start.

Every figure from this route is a figure about the groups you found and managed to enter. The papers that did this as their main method all know it, and the better ones put the sentence in the paper:

• “we are not aware of an approach that would allow us to assess the representativeness of our data as even the total number of groups available in the country is not of public knowledge” [4Resende, Gustavo; Melo, Philipe F.; Sousa, Hugo; Messias, Johnnatan; Vasconcelos, Marisa; Almeida, Jussara M.; Benevenuto, Fabrício (2019): "(Mis)Information Dissemination in WhatsApp: Gathering, Analyzing and Countermeasures", in: Proceedings of the ACM Web Conference. (DOI)]
• “Given that WhatsApp does not provide an API or tools to access the data, there is no way of knowing the representativeness of our dataset” — and so the authors call it “a convenience sample” [8Saha, Punyajoy; Mathew, Binny; Garimella, Kiran; Mukherjee, Animesh (2021): ""Short is the Road that Leads from Fear to Hate": Fear Speech in Indian WhatsApp Groups", in: Proceedings of the ACM Web Conference. (DOI)]
• “The use of Twitter as the only data source for discovering public groups of the different messaging platforms potentially introduces some bias in our sample” [1Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]

Hand-coded: 8 of the 9 papers whose main dataset is group or channel content acknowledge the seed bias or the unknown population. The ninth, [15Gao, Yiran; Xia, Pengcheng; Wang, Liu; Liu, Tianming; Wang, Haoyu (2026): "Doxing-as-a-Service: Demystifying the Chinese Online Doxing Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)], calls its top 100 channels by subscribers “representative” and caveats only a secondary sample of groups. Across all 26, 14 acknowledge it, 4 study one or two known groups or channels where the question does not arise, and 8 say nothing — [15Gao, Yiran; Xia, Pengcheng; Wang, Liu; Liu, Tianming; Wang, Haoyu (2026): "Doxing-as-a-Service: Demystifying the Chinese Online Doxing Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)] and seven papers that use the route as one source among several.

Three further things a reviewer will ask about.

• Survivorship. Groups and channels disappear during the study, and the disappearance is not random. [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] ends its year with 79% of its non-gateway stolen-data channels “inactive/banned”, finds Telegram's September 2024 policy change to be “the most influential predictor of channel durability”, and warns that it “might miss short-lived channels due to the retroactive nature of data collection”. [18Xu, Jiahua; Livshits, Benjamin (2019): "The Anatomy of a Cryptocurrency Pump-and-Dump Scheme", in: Proceedings of the USENIX Security Symposium. (Link)] found 43 of its pump-and-dump channels already deleted. Record when each group was last reachable, and run your collection often enough that a banned channel's messages are already on disk. Messages disappear too: a back-filled history is the set of messages that survived. [7Kireev, Klim; Mykhno, Yevhen; Troncoso, Carmela; Overdorf, Rebekah (2025): "Characterizing and Detecting Propaganda-Spreading Accounts on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] ran real-time collection alongside the export because “The data collected through “Export chat history” does not contain deleted messages”, and the deletions were its subject — moderators removed from below 20% to over 80% of propaganda messages, depending on the channel.
• The big public datasets do not cover niche communities. The Pushshift Telegram dataset (27.8K channels, 317M messages, ICWSM 2020)¹⁰⁾, TGDataset (120,979 channels, KDD 2025)¹¹⁾ and TeraGram (5.9 billion messages from 712 thousand channels and groups, 2015–2025)¹²⁾ are the obvious shortcut. [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] checked: only six of its stolen-data channels — 0.8% — appear in them. A reused dataset is a population the dataset's builder sampled, from their seed.
• Found through a link is not the same as public. A group whose invite link circulates is “public” to anyone who has the link; its members may not think so. [25Arunasalam, Arjun; Farrukh, Habiba; Tekcan, Eliz; Celik, Z. Berkay (2024): "Understanding the Security and Privacy Implications of Online Toxic Content on Refugees", in: Proceedings of the USENIX Security Symposium. (Link)] records a refugee participants' WhatsApp group, “that can only be joined via invitation”, infiltrated after “an unintentional leak of the group's “invite link””. If your seed is a leaked link, your sample includes groups whose members believe they are closed.

The papers name their client far less often than a crawl paper names its browser. Hand-coded across the 26: Telethon 6, the official Telegram API with no client named 7, WhatsApp through physical phones and the Garimella–Tyson collection tool 2, the WhatsApp Web client 1, the Discord API with a user account 1, a commercial scraper service (Apify, Telemetrio) 2, a pump-and-dump aggregator's API (PumpOlymp) 1, a vendor's crawler 1, Selenium 1, by hand 4, and not stated 3. The extraction schema agrees on all seven papers that name a client library.

Verified against each project's repository and package index; scripts/external_checks_messaging_channels.sh re-fetches every row.

None of the three has a research exception in its terms, and read against today's wording all three forbid most of what this literature did — whether the clauses quoted below existed when the 2019–2024 papers collected was not established. That is the same position as scraping in Platforms, but the wording is specific and worth quoting in your ethics section rather than paraphrasing. The one application route is for WhatsApp Channels: Meta's Content Library “provide[s] comprehensive access to the public content archive from Facebook, Instagram and WhatsApp Channels” to approved researchers¹³⁾ — WhatsApp groups are not in it, and no paper here has used it.

• Telegram. The general terms say “Telegram additionally prohibits data scraping as part of its Content Licensing and AI Scraping Terms, which apply to all users, businesses, and third-party services accessing the platform”, and those terms say “Access to user-generated content for any purpose other than ordinary, legitimate, and intended use of the Telegram platform as its user is prohibited”¹⁴⁾. The API terms add that you are “prohibited from using, accessing or aggregating data obtained from the Telegram platform to train, fine-tune or otherwise engage in the development” of machine-learning models¹⁵⁾ — which, read literally, covers training a classifier on messages you collected. Telegram is not designated under the EU Digital Services Act: its own page reports “significantly fewer than 45 million” EU recipients¹⁶⁾, so the vetted-researcher route of Platforms does not reach it.
• WhatsApp. The terms forbid using the service “through automated or other means” in unauthorised ways, including to “collect information of or about our users in any impermissible or unauthorized manner”¹⁷⁾. One thing has changed in the researcher's favour: the Commission designated WhatsApp a very large online platform on 26 January 2026 because of Channels, with “private messaging service” explicitly out of scope¹⁸⁾. Public WhatsApp Channels are therefore inside the DSA's data-access regime; WhatsApp groups are not. Whether WhatsApp has handled an Article 40 request was not checked.
• Discord. The terms forbid “scraping our services without our written consent”, the community guidelines say “Do not use self-bots or user-bots”, and the developer policy says “Do not mine or scrape any data” and forbids training models on message content¹⁹⁾. An automated user account that joins servers from invite links — what [1Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] describes — is the thing all three documents prohibit. A person reading a server as an ordinary member is not what they describe; it does not scale, and it is how [28Guo, Keyan; Utkarsh, Ayush; Ding, Wenbo; Ondracek, Isabelle; Zhao, Ziming; Freeman, Guo; Vishwamitra, Nishant; Hu, Hongxin (2024): "Moderating Illicit Online Image Promotion for Unsafe User Generated Content Games Using Large Vision-Language Models", in: Proceedings of the USENIX Security Symposium. (Link)] appears to have worked.

• Caps, not rate limits, bound scale: the per-account join caps above, and — on WhatsApp — the number of phones you own.
• Rate limits are undocumented as numbers. Telegram documents FLOOD_WAIT_X — “A wait of X seconds is required” — and publishes no per-method rates²⁰⁾. [6Saha Roy, Sayak; Pourabbas Vafa, Elham; Khanmohamaddi, Kobra; Nilizadeh, Shirin (2025): "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] polled each channel “at 10-minute intervals to capture new posts while adhering to the API rate limits”; [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] ran a rate-limited minimal mode between full collections.
• The platform bans your objects, not only you. Six papers report channels removed during collection. [3Vu, Anh V.; Collier, Ben; Thomas, Daniel R.; Kristoff, John; Clayton, Richard; Hutchings, Alice (2025): "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services", in: Proceedings of the USENIX Security Symposium. (Link)] monitored booter Discord channels and found them “often banned rapidly by Discord”; Telegram channels survived longer, which is part of why the booter literature is a Telegram literature.

Four papers in these venues use a messenger's contact discovery — upload phone numbers, learn which are registered — to measure accounts rather than groups. It is a separate route with a separate denominator (the numbering plan, not a seed), and this page treats it as a pointer rather than a section of the method: the design question is a census of accounts, and Platforms already carries its largest example. It belongs here because its ethics and rate-limit history is the clearest record of how a messenger responds to measurement at scale:

Read that table as a warning about limits, not a promise. The absence of a limit in one measurement window is not permission, and the 2026 paper spent a year in disclosure with Meta before publication.

Ethics covers crawling, robots.txt, load, residential proxies and data donation. It does not yet cover this route, and this route is different in kind: the members of a group are identifiable people talking to each other, a researcher who joins is present in the room, and the platform's terms forbid the collection. What the 26 papers did, hand-coded from their text:

The extraction schema, reading the same 26 papers independently, finds a stated review outcome in 17 of 26 (65.4%) — one more than the hand codes, because it reads [31Acharya, Bhupendra; Lazzaro, Dario; Cinà, Antonio Emanuele; Holz, Thorsten (2025): "Pirates of Charity: Exploring Donation-based Abuses in Social Media Platforms", in: Proceedings of the ACM Web Conference. (DOI)]'s sentence that the research “did not directly involve interaction with any human subjects” as a review decision — against 33.8% of all 5,118 empirical papers in the corpus. Group studies report ethics review about twice as often as the average paper here, and still leave more than a third silent.

What individual careful papers did, stated so you can adopt or argue with it — most bullets rest on one or two papers, and one is contested:

• Enter only the way any member would. “We do not lie or pretend to be an interested buyer to be admitted into groups. We also do not attempt to join any groups that require payments or vouching by an existing member.” [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] None of the 26 says it entered a group by deception. One went further than observing: [30He, Bowen; Hu, Yufeng; Chen, Zhuo; Chen, Yuan; Yu, Ting; Chang, Rui; Wu, Lei; Zhou, Yajin (2025): "Unmasking the Shadow Economy: A Deep Dive into Drainer-as-a-Service Phishing on Ethereum", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] “joined several related Telegram groups” of wallet-drainer operators, “communicated with operators, acquired wallet drainers”, and did so from anonymised accounts without paying anything. If your design needs interaction, it is a different ethics case from lurking, and your review should see it as one.
• Consent is waived, not assumed, and the waiver is argued. [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] cites the British Society of Criminology's guidance that consent may be waived for publicly accessible online communities studied as collective patterns; [3Vu, Anh V.; Collier, Ben; Thomas, Daniel R.; Kristoff, John; Clayton, Richard; Hutchings, Alice (2025): "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services", in: Proceedings of the USENIX Security Symposium. (Link)] did not seek consent because “sending thousands of messages could be regarded as spamming”, analysed collectively, and paraphrased every quote. Neither argument covers a small group whose members expect privacy.
• Minimise at collection, not at publication. Hash phone numbers ([1Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]); map names to identifiers and discard them ([4Resende, Gustavo; Melo, Philipe F.; Sousa, Hugo; Messias, Johnnatan; Vasconcelos, Marisa; Almeida, Jussara M.; Benevenuto, Fabrício (2019): "(Mis)Information Dissemination in WhatsApp: Gathering, Analyzing and Countermeasures", in: Proceedings of the ACM Web Conference. (DOI)]); do not download payloads that contain other people's data ([6Saha Roy, Sayak; Pourabbas Vafa, Elham; Khanmohamaddi, Kobra; Nilizadeh, Shirin (2025): "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)]: “we did not download or read the payload files”); cap file types and sizes ([5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)]); paraphrase quotes so a member cannot be found by searching ([3Vu, Anh V.; Collier, Ben; Thomas, Daniel R.; Kristoff, John; Clayton, Richard; Hutchings, Alice (2025): "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services", in: Proceedings of the USENIX Security Symposium. (Link)]).
• Keep collected messages away from third-party services — contested. [5Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)] classified messages with a local model “to avoid sending stolen and potentially sensitive data to third-party servers”. [6Saha Roy, Sayak; Pourabbas Vafa, Elham; Khanmohamaddi, Kobra; Nilizadeh, Shirin (2025): "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)], one of the five papers to read first, did the opposite: “we utilized the GPT-4 API” to classify 11,800 collected posts. Sending group messages to a hosted model moves them to a party the members never heard of, and on Telegram sits badly with the terms quoted above; this page sides with the local model, but the field has not settled it.
• Declining is a legitimate design. [32Li, Jiliang; Lu, Nora Sinong; Hanimann, Isaak; Si, Janice Jianing; Cheng, Dazhao; Zhou, Xiaobo; Wang, Kanye Ye (2025): "Investigating the Impact of Online Community Involvement on Safety Practices and Perceived Risks Among People Who Use Drugs", in: Proceedings of the USENIX Security Symposium. (Link)] — not one of the 26, because it declined — studied people who use drugs and wrote: “Although PWUD is also active in other online communities such as Telegram groups and self-constructed forums, for ethical reasons, we limited our online data collection to publicly accessible platforms.”

What members expect depends on the group. Hong Kong protesters interviewed by [12Albrecht, Martin R.; Blasco, Jorge; Jensen, Rikke Bjerg; Mareková, Lenka (2021): "Collective Information Security in Large-Scale Urban Protests: the Case of Hong Kong", in: Proceedings of the USENIX Security Symposium. (Link)] distinguished large public Telegram groups — “all participants in our study also assumed police monitoring of the public Telegram groups” — from small groups of people who knew each other. The refugee group of [25Arunasalam, Arjun; Farrukh, Habiba; Tekcan, Eliz; Celik, Z. Berkay (2024): "Understanding the Security and Privacy Implications of Online Toxic Content on Refugees", in: Proceedings of the USENIX Security Symposium. (Link)] was invitation-only and experienced an outsider's arrival as an attack. Size, how the link circulates and what the group is for are the variables; “public” is not one bit.

Outside these venues, the Association of Internet Researchers' guidelines (3.0, approved 6 October 2019) have no passage specific to messaging groups — the nearest is their discussion of password-protected, “quasi-public” fora²¹⁾. The guidance written for this route is Barbosa and Milan's “Do Not Harm in Private Chat Apps” (2019), which argues for taking infrastructure seriously, avoiding “by all means covert bypasses” and guaranteeing full anonymisation²²⁾.

All figures below come from the publication corpus of seven venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026, 5,859 extracted papers of which 5,855 have extractable full text. The script is scripts/report_messaging_channels.mjs; its unedited output, every probe, the full list of verdicts and the hand codes are on messaging_channels.

A paper counts if it collects data from inside messaging-platform groups, channels or servers — Telegram, WhatsApp, Discord, or another messenger's group feature — as a measurement source: it finds groups or channels, joins, subscribes, reads their public preview or has a scraper do so, and records messages, members, media or metadata. It is core if that data is its main dataset and section if it is one source among several. Harvesting invite links without entering, enumerating accounts, reusing someone else's group dataset, recruiting participants in groups, and studying the protocol or app are recorded but do not count.

The candidate set is the union of three probes over full text and the extraction schema — a platform name ten or more times, route vocabulary (invite links, t.me, chat.whatsapp.com, discord.gg, Telethon, TDLib, TGStat, Disboard and similar) with at least three mentions of the three platforms combined, or a platform named in a paper's title, population sources, measured phenomena or tools — giving 144 papers, plus 3 added by hand from a recall probe. The 44 that looked like group studies or close neighbours were read in full; the other 103 were decided from the sentence around every platform-name and route-vocabulary hit. Every one of the 147 has a verdict:

How well a name count finds the population:

The gap rule misses three papers that name the platform fewer than ten times — one Telegram supergroup in a forum study [33Sun, Zhibo; Oest, Adam; Zhang, Penghui; Rubio-Medrano, Carlos; Bao, Tiffany; Wang, Ruoyu; Zhao, Ziming; Shoshitaishvili, Yan; Doupé, Adam; Ahn, Gail-Joon (2021): "Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service", in: Proceedings of the USENIX Security Symposium. (Link)], one Telegram channel in a cyberwar study [20Vu, Anh V.; Thomas, Daniel R.; Collier, Ben; Hutchings, Alice; Clayton, Richard; Anderson, Ross J. (2024): "Getting Bored of Cyberwar: Exploring the Role of Low-level Cybercrime Actors in the Russia-Ukraine Conflict", in: Proceedings of the ACM Web Conference. (DOI)], and two Discord channels among five prompt sources [22Yu, Zhiyuan; Liu, Xiaogeng; Liang, Shunning; Cameron, Zach; Xiao, Chaowei; Zhang, Ning (2024): "Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models", in: Proceedings of the USENIX Security Symposium. (Link)]. The recall of the candidate set is 100% by construction against the population it produced; the recall probe outside it found three more candidates, none of which turned out to be in the population.

Per year: 2019:2, 2020:3, 2021:4, 2023:1, 2024:6, 2025:7, 2026:3. Per venue: USENIX Security 12, TheWebConf 7, IMC 3, IEEE S&P 2, NDSS 1, CCS 1, PoPETs 0. 2025–2026 is provisional: CCS 2026 and IMC 2026 have not been held, and IEEE S&P 2026 and TheWebConf 2026 are under-selected by construction (corpus). With 26 papers, read these as counts, not a trend.

Two shapes are visible even at this size. The platform shifted: all three WhatsApp papers are from 2019–2021, and every paper from 2022 on is Telegram or Discord — 21 papers use Telegram. The subject shifted: the five 2019–2021 core papers study political misinformation (two), crypto pump-and-dump channels, engagement pods and the messaging ecosystem itself; three of the four 2025–2026 core papers study cybercrime markets. No paper from 2022–2024 has group content as its main dataset. By hand-coded object: cybercrime and fraud markets 9, politics and misinformation 5, scams and impersonation 2, extremism and harassment 2, AI jailbreak prompts 2, and one each for crypto pump-and-dump, the messaging ecosystem itself, censorship circumvention, engagement manipulation, unsafe game content, and a traffic model for an attack.

Each figure with the paper's own denominator; each checked against the paper's full text by scripts/verify_messaging_channels_figures.mjs.

Every probe, the inclusion rule, all 147 verdicts with a one-line reason, the 26 papers' hand codes, the precision and recall arithmetic, the quote checks and the external sources with their fetch dates are on messaging_channels. Corpus-level caveats — the seven-venue scope, the provisional 2025–2026 slice, extraction stability — are on corpus.

Four limits worth restating. The corpus is seven security, privacy and measurement venues; the largest body of Telegram and WhatsApp group research is in ICWSM, CSCW, communication journals and political science, none of which is in it — so 26 is a count for these seven venues, not for the field, and the Pushshift, TGDataset and TeraGram datasets above are all from outside them. The hand codes are one reader's coding of what each paper states: “not stated” means the paper does not say, not that it did not happen. The 44 papers read in full were read by four sub-agents whose notes were machine-checked (82.7% of their quotes located verbatim); the verdicts and codes were then decided by one person, and no second coder was used. And the candidate probes are keyword probes: a paper that joined WeChat or LINE groups and never named Telegram, WhatsApp or Discord is caught only by the smaller recall probe.

A group study should let a reader reconstruct which groups you could see, from when, and how you behaved in them. Report:

1. The seed, by name — which directory, which search terms, which platform's links, which snowball rule — and every stage of the funnel: candidates found, candidates examined, reachable, joined, collected.
2. How you entered: joined as a member, read a public preview, a bot added by an admin, or a scraper service (and which). 6 of 26 papers here do not say.
3. The time window per group: from joining, or back-filled to what date. 18 of 26 do not say whether they back-filled.
4. What you recorded: messages, member lists, media, reactions — and what you deliberately did not.
5. Your accounts: how many, how the numbers were obtained, which client and version, and any bans or flood-waits.
6. Attrition: groups that disappeared, links that expired, admins who removed you — with dates.
7. Ethics review and the terms position you took, and whether you ever posted or interacted. 10 of 26 say nothing about review.
8. What you can share: channel identifiers, message identifiers and code even where the messages themselves cannot be released. By the extraction's reading, 9 of 26 (34.6%) release data publicly against 47.7% of all empirical papers, while 5 release it only on request and 3 under restriction, against 1.7% and 1.4% — group studies share less openly and shift to gated release; see Artifacts.

• Platforms — the other routes into a platform: APIs, research programmes, ad archives, scraping, sock puppets, donation and access requests.
• Ad archives — the sibling route page: an instrument the platform builds for you, where this page's is one it tolerates.
• Ethics — review, harm and disclosure in general; it does not yet cover entering groups.
• Existing datasets — reusing a group dataset means inheriting its builder's seed.
• User studies — recruiting in groups and servers, and interviewing people about their groups.
• Online scams and Phishing — where the Telegram cybercrime channels lead: the scam site and the phishing kit.
• Registration — the accounts and phone numbers this route consumes.
• Biases — convenience samples and survivorship, which every figure on this page carries.
• Artifacts — what you can deposit when the messages cannot be released.
• messaging_channels — every probe, verdict, hand code, quote check and external source behind this page.

[1]

Hoseini, Mohamad; Melo, Philipe; Junior, Manoel; Benevenuto, Fabrício; Chandrasekaran, Balakrishnan; Feldmann, Anja; Zannettou, Savvas (2020): "Demystifying the Messaging Platforms' Ecosystem Through the Lens of Twitter", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[2]

Shen, Xinyue; Chen, Zeyuan; Backes, Michael; Shen, Yun; Zhang, Yang (2024): ""Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[3]

Vu, Anh V.; Collier, Ben; Thomas, Daniel R.; Kristoff, John; Clayton, Richard; Hutchings, Alice (2025): "Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services", in: Proceedings of the USENIX Security Symposium. (Link)

[4]

Resende, Gustavo; Melo, Philipe F.; Sousa, Hugo; Messias, Johnnatan; Vasconcelos, Marisa; Almeida, Jussara M.; Benevenuto, Fabrício (2019): "(Mis)Information Dissemination in WhatsApp: Gathering, Analyzing and Countermeasures", in: Proceedings of the ACM Web Conference. (DOI)

[5]

Marjanov, Tina; Tsuchiya, Taro; Ioannidis, Konstantinos; Hughes, Jack; Christin, Nicolas; Hutchings, Alice (2026): "Stayin' Alive: How Global Stolen Data Markets Thrive on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)

[6]

Saha Roy, Sayak; Pourabbas Vafa, Elham; Khanmohamaddi, Kobra; Nilizadeh, Shirin (2025): "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)

[7]

Kireev, Klim; Mykhno, Yevhen; Troncoso, Carmela; Overdorf, Rebekah (2025): "Characterizing and Detecting Propaganda-Spreading Accounts on Telegram", in: Proceedings of the USENIX Security Symposium. (Link)

[8]

Saha, Punyajoy; Mathew, Binny; Garimella, Kiran; Mukherjee, Animesh (2021): ""Short is the Road that Leads from Fear to Hate": Fear Speech in Indian WhatsApp Groups", in: Proceedings of the ACM Web Conference. (DOI)

[9]

Wang, Hongyu; Li, Ying; Huang, Ronghong; Mi, Xianghang (2025): "Detecting and Understanding the Promotion of Illicit Goods and Services on Twitter", in: Proceedings of the ACM Web Conference. (DOI)

[10]

Gegenhuber, Gabriel K.; Frenzel, Philipp E.; Günther, Maximilian; Ullrich, Johanna; Judmayer, Aljosha (2026): "Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[11]

Chou, Kai-Hsiang; Lin, Yi-Min; Wang, Yi-An; Li, Jonathan Weiping; Kim, Tiffany Hyun-Jin; Hsiao, Hsu-Chun (2025): "Bots can Snoop: Uncovering and Mitigating Privacy Risks of Bots in Group Chats", in: Proceedings of the USENIX Security Symposium. (Link)

[12]

Albrecht, Martin R.; Blasco, Jorge; Jensen, Rikke Bjerg; Mareková, Lenka (2021): "Collective Information Security in Large-Scale Urban Protests: the Case of Hong Kong", in: Proceedings of the USENIX Security Symposium. (Link)

[13]

Edu, Jide S.; Mulligan, Cliona; Pierazzi, Fabio; Polakis, Jason; Suarez-Tangil, Guillermo; Such, Jose M. (2022): "Exploring the security and privacy risks of chatbots in messaging services", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[14]

Li, Xigao; Rahmati, Amir; Nikiforakis, Nick (2024): "Like, Comment, Get Scammed: Characterizing Comment Scams on Media Platforms", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[15]

Gao, Yiran; Xia, Pengcheng; Wang, Liu; Liu, Tianming; Wang, Haoyu (2026): "Doxing-as-a-Service: Demystifying the Chinese Online Doxing Ecosystem", in: Proceedings of the ACM Web Conference. (DOI)

[16]

Bijmans, Hugo; Booij, Tim; Schwedersky, Anneke; Nedgabat, Aria; Wegberg, Rolf van (2021): "Catching Phishers By Their Bait: Investigating the Dutch Phishing Landscape through Phishing Kit Detection", in: Proceedings of the USENIX Security Symposium. (Link)

[17]

Aliapoulios, Maxwell; Take, Kejsi; Ramakrishna, Prashanth; Borkan, Daniel; Goldberg, Beth; Sorensen, Jeffrey; Turner, Anna; Greenstadt, Rachel; Lauinger, Tobias; McCoy, Damon (2021): "A large-scale characterization of online incitements to harassment across platforms", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[18]

Xu, Jiahua; Livshits, Benjamin (2019): "The Anatomy of a Cryptocurrency Pump-and-Dump Scheme", in: Proceedings of the USENIX Security Symposium. (Link)

[19]

Vu, Anh V.; Hutchings, Alice; Anderson, Ross J. (2024): "No Easy Way Out: the Effectiveness of Deplatforming an Extremist Forum to Suppress Hate and Harassment", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[20]

Vu, Anh V.; Thomas, Daniel R.; Collier, Ben; Hutchings, Alice; Clayton, Richard; Anderson, Ross J. (2024): "Getting Bored of Cyberwar: Exploring the Role of Low-level Cybercrime Actors in the Russia-Ukraine Conflict", in: Proceedings of the ACM Web Conference. (DOI)

[21]

Bahramali, Alireza; Houmansadr, Amir; Soltani, Ramin; Goeckel, Dennis; Towsley, Don (2020): "Practical Traffic Analysis Attacks on Secure Messaging Applications", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[22]

Yu, Zhiyuan; Liu, Xiaogeng; Liang, Shunning; Cameron, Zach; Xiao, Chaowei; Zhang, Ning (2024): "Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models", in: Proceedings of the USENIX Security Symposium. (Link)

[23]

Weerasinghe, Janith; Flanigan, Bailey; Stein, Aviel J.; McCoy, Damon; Greenstadt, Rachel (2020): "The Pod People: Understanding Manipulation of Social Media Popularity via Reciprocity Abuse", in: Proceedings of the ACM Web Conference. (DOI)

[24]

Vafa, Elham Pourabbas; Singhal, Mohit; Thota, Poojitha; Roy, Sayak Saha (2025): "Learning from Censored Experiences: Social Media Discussions around Censorship Circumvention Technologies", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[25]

Arunasalam, Arjun; Farrukh, Habiba; Tekcan, Eliz; Celik, Z. Berkay (2024): "Understanding the Security and Privacy Implications of Online Toxic Content on Refugees", in: Proceedings of the USENIX Security Symposium. (Link)

[26]

Hagen, Christoph; Weinert, Christian; Sendner, Christoph; Dmitrienko, Alexandra; Schneider, Thomas (2021): "All the Numbers are US: Large-scale Abuse of Contact Discovery in Mobile Messengers", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[27]

Kang, Junkyu; Lee, Soyoung; Kwon, Yonghwi; Son, Sooel (2026): "Connecting the Dots: An Investigative Study on Linking Private User Data Across Messaging Apps", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[28]

Guo, Keyan; Utkarsh, Ayush; Ding, Wenbo; Ondracek, Isabelle; Zhao, Ziming; Freeman, Guo; Vishwamitra, Nishant; Hu, Hongxin (2024): "Moderating Illicit Online Image Promotion for Unsafe User Generated Content Games Using Large Vision-Language Models", in: Proceedings of the USENIX Security Symposium. (Link)

[29]

Schrittwieser, Sebastian; Frühwirt, Peter; Kieseberg, Peter; Leithner, Manuel; Mulazzani, Martin; Huber, Markus; Weippl, Edgar (2012): "Guess Who’s Texting You? Evaluating the Security of Smartphone Messaging Applications", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[30]

He, Bowen; Hu, Yufeng; Chen, Zhuo; Chen, Yuan; Yu, Ting; Chang, Rui; Wu, Lei; Zhou, Yajin (2025): "Unmasking the Shadow Economy: A Deep Dive into Drainer-as-a-Service Phishing on Ethereum", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[31]

Acharya, Bhupendra; Lazzaro, Dario; Cinà, Antonio Emanuele; Holz, Thorsten (2025): "Pirates of Charity: Exploring Donation-based Abuses in Social Media Platforms", in: Proceedings of the ACM Web Conference. (DOI)

[32]

Li, Jiliang; Lu, Nora Sinong; Hanimann, Isaak; Si, Janice Jianing; Cheng, Dazhao; Zhou, Xiaobo; Wang, Kanye Ye (2025): "Investigating the Impact of Online Community Involvement on Safety Practices and Perceived Risks Among People Who Use Drugs", in: Proceedings of the USENIX Security Symposium. (Link)

[33]

Sun, Zhibo; Oest, Adam; Zhang, Penghui; Rubio-Medrano, Carlos; Bao, Tiffany; Wang, Ruoyu; Zhao, Ziming; Shoshitaishvili, Yan; Doupé, Adam; Ahn, Gail-Joon (2021): "Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Service", in: Proceedings of the USENIX Security Symposium. (Link)

[34]

Recabarren, Ruben; Carbunar, Bogdan; Hernandez, Nestor; Shafin, Ashfaq Ali (2023): "Strategies and Vulnerabilities of Participants in Venezuelan Influence Operations", in: Proceedings of the USENIX Security Symposium. (Link)

[35]

Acharya, Bhupendra; Lazzaro, Dario; López-Morales, Efrén; Oest, Adam; Saad, Muhammad; Cinà, Antonio Emanuele; Schönherr, Lea; Holz, Thorsten (2024): "The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms", in: Proceedings of the USENIX Security Symposium. (Link)

[36]

Cinus, Federico; Minici, Marco; Luceri, Luca; Ferrara, Emilio (2025): "Exposing Cross-Platform Coordinated Inauthentic Activity in the Run-Up to the 2024 U.S. Election", in: Proceedings of the ACM Web Conference. (DOI)

[37]

Weyns, Maarten; Ferrero, Dario; Beek, Stefan Op de; Wagner, Daniel; Smaragdakis, Georgios; Griffioen, Harm (2026): "From Mirai to Gorilla: Deep Dive into a Long-Lasting DDoS-for-Hire Botnet", in: Proceedings of the USENIX Security Symposium. (Link)