14 of 14 Borshchahivka Torpedoes Alive After 5 Days: Why Billion-Hryvnia Telecom SORM Boxes Are Blind in Telegram and How to Block Nomadic Provocateurs by MTProto UID for Free

Engineering audit as of November 7, 2026 (Day 5 after the November 2, 2026 kinetic-information provocation at the temporary staging point of 1st NGU Corps 'Azov' Unit 3121 in Petropavlivska Borshchahivka and the November 4, 2026 road blockades in Kyiv): 100% (14 of 14) of named Telegram seeding and cross-district riot torpedoes remain active and unblocked, while 8 unnamed fresh zero-accounts (UID series 78.../79.../88.../89...) freely post direct incitement to burn police vehicles and assault law enforcement officers in Kyiv mega-channel comment threads. We publish a technical breakdown of telecom SORM/DPI blindness against MTProto 2.0 encryption alongside the open machine-readable stop-feed /feeds/telegram-nomadic-torpedoes.json for zero-cost 0.1 ms automated blocking.

1. Empirical Finding as of 2026-11-07: 14 of 14 Named Telegram Torpedoes (100%) Remain ALIVE on Day 5 Post-Incident

Live verification of https://t.me/<username> web profiles and public Telegram discussion graphs as of November 7, 2026 (07:39 UTC) — exactly 5 days after the siege and night assault on the temporary staging point (PPD) of National Guard Unit 3121 (1st NGU Corps 'Azov') at 7 Soniachna St., Petropavlivska Borshchahivka (2026-11-02, where 16 National Guardsmen suffered injuries and chemical burns, and lead operative Valentyna Moloda was remanded into custody for 60 days without bail by the Solomianskyi District Court of Kyiv on 2026-11-04 under Articles 114-1 and 114-2 of the Criminal Code of Ukraine; see /en/issue/borshchahivka-provocation-2026-11-02 and /en/methods/borshchahivka-matryoshka-bundestag-fimi-conveyor) — establishes a stark engineering fact:

• Out of 14 verified named Telegram torpedoes (comprising Echelon-1 single-use paratroopers, a 1-subscriber SendAsPeer channel mask, and cross-district nomads deployed during the 2026-11-04 Kyiv blackout roadblocks), all 14 of 14 (100% ALIVE) remain active and unblocked.
• Zero initial seeding messages in open district chats (t.me/petropavlivskabor/33717..33720, t.me/SofievskayaPetropavBorshchagovka/1644075, t.me/koperchat2026/1749076, t.me/petropavlivskabor/33746, t.me/petropavlivskabor/33845) have been removed by platform or community moderators as of Day 5.
• Furthermore, in the discussion threads of Kyiv mega-channel @truexakyiv (https://t.me/truexakyiv/96829 and https://t.me/truexakyiv/96835 during the 2026-11-04 road blockades on Akademmistechko/Palladina Ave and Obolon), our MTProto audit documented 8 unnamed provocateurs (username = NULL) identifiable solely by their immutable 64-bit numeric MTProto user_id — including fresh series account uid=8895205236 posting direct Russian-language incitement to burn police vehicles and kill law enforcement officers.

#### Complete Verification Table of 22 MTProto Torpedoes (14 Named + 8 Null-Username Accounts) as of 2026-11-07

2. Forensic Anatomy of the Infiltration: Echelon-1 Paratroopers, SendAsPeer (PeerChannel) Masks & Null-Username 889... Series Zeroes

Cross-correlating live t.me/?embed=1 captures with raw MTProto discussion dumps exposes the three technical evasion mechanisms that allow Russian kinetic-information operators to bypass conventional moderation in Ukrainian mega-channels and municipal chats:

• Null-Username Fresh Zeroes (username = NULL, UID >= 6,500,000,000) as Manual-Search Stealth Nodes:
• When fresh account 8895205236 (2026-11-04, 19:06:07 UTC under @truexakyiv/96829) or 8940324745 (Kharkivskyi, 1m 59s sync with @RVvoenkor/126470) posts incitement to burn police cars or block highways, its @username field is intentionally left empty (NULL).
• To a human moderator or URL-based OSINT scraper, the account has no t.me/<username> link and its display_name can be changed every sixty seconds. Yet at the MTProto and Telegram Bot API protocol layer, every single packet carries the immutable 64-bit integer from_id: PeerUser(user_id=8895205236).
• Anonymous SendAsPeer Channel Masks (PeerChannel Replacing PeerUser):
• In @koperchat2026/1749076 (2026-11-02, 16:56:19 UTC), the operative hid their personal PeerUser account behind Telegram Premium's SendAsPeer feature, posting as a 1-subscriber shell channel @kyivskiydvish (channel_id=3913826799, Bot API sender_chat.id = -1003913826799) renamed to the single Cyrillic letter 'l'.
• Clicking the author avatar opens an empty 1-subscriber channel rather than the operator's user profile.
• Cross-District Nomadism Across Disconnected Municipal Threads:
• Nomad @Denov1977b (uid=5225374042) and zero-account uid=8940324745 hop sequentially between Petropavlivska Borshchahivka (Buchanskyi district, western suburb), Palladina Ave (Sviatoshynskyi district), and Obolon (Yordanska St.), artificially stitching local power-outage complaints into the Borshchahivka military staging point provocation.

3. Why Billion-Hryvnia ISP SORM / DPI Hardware Boxes Are Architecturally Blind in Telegram

A recurring institutional fallacy is the belief that Telegram provocations can be countered by procuring expensive network-level lawful interception and Deep Packet Inspection (SORM / DPI) appliances deployed on Ukrainian telecom operators and Internet Service Providers (ISPs). From a network engineering standpoint, ISP-level DPI suffers from three fundamental architectural blind spots:

• Foreign VoIP / eSIM Registration Outside Ukrainian HLR/VLR Databases:
• GRU 85th GTSSS units and contractor botfarms do not buy Ukrainian +380 SIM cards at Kyiv street kiosks. Accounts in the 669..., 673..., 783..., 791..., 817..., 889..., and 894... ranges are bulk-minted via foreign virtual telephony gateways (VoIP / SIM-box pools in Indonesia +62, the UK +44, Estonia +372, Russia +7, or anonymous +888 Fragment blockchain numbers).
• Zero SMS verification codes or SS7 / Diameter signaling packets ever traverse Ukrainian mobile operator switches.
• End-to-Server MTProto 2.0 Cryptographic Opacity (AES-256-IGE + TL-schema + Obfuscated2):
• Even when an operative or proxy exits via a Ukrainian ISP, the Telegram client encrypts all application payload using MTProto 2.0 (256-bit AES-IGE keyed via 2048-bit Diffie-Hellman, wrapped inside TLS 1.3 obfuscation to Telegram AS62041 / AS62014 edge blocks 149.154.160.0/20 and 91.108.4.0/22).
• An optical splitter or SORM/DPI probe on a Ukrainian ISP backbone sees only an encrypted byte stream to a Telegram edge IP in Amsterdam (DC2 / DC4). ISP hardware cannot inspect the destination chat_id (@truexakyiv), the sender's user_id (8895205236), or the message text.
• Absence of a Public UID -> MSISDN Reverse Lookup:
• Under MTProto, phone numbers default to server-side privacy (PrivacyKeyPhoneNumber = Nobody), rendering telecom billing lookups useless against a null-username account like uid=8895205236.

4. Where the Real Solution Lies: Zero-Cost Application-Layer MTProto UID Filtering in 0.1 ms (/feeds/telegram-nomadic-torpedoes.json)

The engineering paradox is simple: the exact metadata that is cryptographically invisible to a billion-hryvnia SORM box on an ISP fiber link is delivered in 100% decrypted cleartext JSON / TL-objects directly to every community moderator bot, every mega-channel discussion group (@truexakyiv, @kievreal1, @k_dvizh, @koperchat2026, @petropavlivskabor), and every news intake bot (@novosti_kieva_bot, @levii_bereg_kyivbot) the millisecond a comment is posted.

Whenever a provocateur posts in a discussion group or submits content to an intake bot, Telegram's servers hand the administrator bot the exact immutable identifiers:

• message.from_user.id (MTProto PeerUser.user_id — an immutable 64-bit integer that survives display-name changes and @username deletion);
• message.sender_chat.id (MTProto PeerChannel.channel_id — populated whenever an anonymous SendAsPeer channel mask is used);
• message.from_user.username (None when @username is stripped).

To close this vulnerability across Ukrainian municipal channels, OPERBAZA has published the open machine-readable stop-feed /feeds/telegram-nomadic-torpedoes.json, enabling any community moderator bot to neutralize nomadic torpedoes in 0.1 ms using three deterministic rules:

```python

Drop-in integration of the open OPERBAZA stop-feed (/feeds/telegram-nomadic-torpedoes.json)

for any Telegram discussion-group moderator bot or news intake bot (Python / aiogram / PTB):

import re, urllib.request, json

FEED_URL = "https://operbaza.org/feeds/telegram-nomadic-torpedoes.json"

feed = json.loads(urllib.request.urlopen(FEED_URL, timeout=5).read().decode("utf-8"))

BLOCKED_USER_IDS = set(feed["instant_blocklists"]["mtproto_user_ids_int"])

BLOCKED_CHAT_IDS = set(feed["instant_blocklists"]["bot_api_sender_chat_ids_int"])

FRESH_UID_THRESHOLD = int(feed["instant_blocklists"]["fresh_zero_uid_quarantine_threshold"]) # 6500000000

VIOLENCE_OR_RIOT_RE = re.compile(

r"(kill.*cops|burn.*cars|storm|blockade|overthrow)",

re.IGNORECASE,

)

def inspect_incoming_message(msg) -> str:

Rule 1: Blanket ban on anonymous SendAsPeer channel masks (e.g. PeerChannel 3913826799 'l')

if getattr(msg, "sender_chat", None) is not None:

if msg.sender_chat.id != getattr(msg, "linked_chat_id", None):

return "DROP_AND_BAN_SEND_AS_CHANNEL_MASK"

user = getattr(msg, "from_user", None)

if not user:

return "ALLOW"

Rule 2: Instant O(1) ban by immutable 64-bit MTProto user_id from OPERBAZA stop-feed

if user.id in BLOCKED_USER_IDS:

return "DROP_AND_BAN_KNOWN_TORPEDO_UID"

Rule 3: Quarantine fresh null-username accounts (UID >= 6,500,000,000) on riot/violence triggers

text = (getattr(msg, "text", None) or getattr(msg, "caption", None) or "")

if user.id >= FRESH_UID_THRESHOLD and not getattr(user, "username", None):

if VIOLENCE_OR_RIOT_RE.search(text):

return "QUARANTINE_FRESH_UNNAMED_ZERO_ON_VIOLENCE_TRIGGER"

return "ALLOW"

```

5. Direct Links to Verified Datasets & Cross-Linked OPERBAZA Registries

• Open Anti-Torpedo MTProto JSON Stop-Feed (CC-BY-4.0): /feeds/telegram-nomadic-torpedoes.json
• Full Forensic Investigation of the Petropavlivska Borshchahivka Operation (02–05.11.2026): /en/issue/borshchahivka-provocation-2026-11-02
• Methodological Breakdown of the 'Borshchahivka -> Matryoshka -> Bundestag (AfD)' Pipeline (M-11): /en/methods/borshchahivka-matryoshka-bundestag-fimi-conveyor
• Verified Russian Botfarm Registry (1,839 nodes + EU DSA / DISARM Matrix): /en/bots (M-21: /en/methods/method-21-eu-dsa-fimi-cib-forensic-report-meta-google-dg-connect-2026)
• Institutional Blindness & Regulatory Compliance Registry: /en/blindness (/feeds/agency-blindness.json)