Selling Success: Inside the Telegram Network Behind Alleged NEET Paper Leaks

The National Eligibility cum Entrance Test (NEET) is India's largest medical entrance examination and serves as the primary gateway for admission to undergraduate medical and dental programs across the country. Every year, millions of students compete for a limited number of seats, making the examination one of the most competitive and closely watched in India.

That immense demand has also made NEET a recurring target for fraud. In the weeks leading up to the examination, social media platforms and messaging applications are frequently flooded with claims of leaked question papers, guaranteed answer keys, and offers promising access to the exam before test day. While many of these claims ultimately prove to be scams, allegations of genuine paper leaks have surfaced repeatedly over the years, blurring the line between opportunistic fraud and potentially organized criminal activity.

Against this backdrop, StealthMole identified a Telegram-based network actively promoting alleged NEET paper leaks ahead of the examination. What initially appeared to be a single advertisement soon developed into a broader investigation, revealing interconnected channels, recurring promotional tactics, and historical digital footprints that persisted even after some accounts had been removed from the platform.

This report examines that ecosystem, tracing the actors, infrastructure, and promotional strategies used to market alleged leaked examination papers while demonstrating how historical Telegram intelligence can help reconstruct online activity that might otherwise have disappeared.

Selling the Dream

The investigation was prompted by renewed public attention surrounding the NEET paper leak controversy in India. As allegations and media reports once again brought examination security into the spotlight, the objective was straightforward: to determine whether these discussions had left a measurable footprint within Telegram's underground communities and whether any actors were actively attempting to exploit the situation.

Using StealthMole's Telegram Tracker, initial searches for keywords such as "NEET" and "Exam" returned thousands of messages. Most consisted of news coverage, public discussions, and students debating the controversy. Buried among them, however, were a series of advertisements claiming to offer access to the NEET question paper before the examination. Rather than appearing as isolated posts, these messages surfaced repeatedly across different Telegram communities, each directing prospective buyers towards dedicated contact points or channels.

As the advertisements were reviewed more closely, recurring patterns began to emerge. Different accounts used remarkably similar language, promising "100% paper matches," advertising limited booking slots, and encouraging students to move into private conversations to complete transactions. Although none of these claims could be independently verified, the consistency of the messaging suggested a coordinated promotional effort rather than spontaneous opportunistic posts.

What began as a simple attempt to gauge the underground reaction to a high-profile national controversy quickly evolved into a broader investigation. Each new contact, channel, and advertisement opened another path to follow, gradually revealing that the alleged sale of leaked examination papers was part of a much larger Telegram ecosystem than initially expected.

Following the Advertisements

The initial advertisements uncovered through StealthMole's Telegram Tracker quickly demonstrated that the campaign extended beyond simple claims of leaked examination papers. Although different accounts were responsible for posting the messages, the advertisements followed a remarkably consistent pattern, suggesting that similar marketing tactics were being reused across multiple Telegram communities.

One of the earliest advertisements was identified in the Telegram channel PEER 2 PEER EXCHANGE, where a user publicly invited anyone interested in obtaining the NEET examination paper to contact a dedicated Telegram account.

• Telegram Channel: https://t.me/E*******p
• Message: "KISIKO NEET EXAM KA QUESTION PAPER CHAIYE TOH DM KARO"
• Translation: Who wants NEET Exam question paper, DM me
• Contact Identifier: @Neet********7

Rather than relying on a single promotional message, the campaign continued with increasingly aggressive claims. In subsequent posts, the same campaign publicly challenged India's National Testing Agency (NTA), dismissing official assurances that the RE-NEET examination paper would remain secure. One message openly declared that the authorities would be unable to prevent another leak before ending with an "Open Challenge" directed at the NTA.

The campaign did not stop at challenging the authorities. Additional advertisements introduced familiar scarcity tactics intended to create urgency among prospective buyers. Messages repeatedly claimed that bookings had opened, that only a limited number of students would receive the paper, and that interested candidates should secure their place before registrations closed. Several posts also promised that the examination paper would be delivered shortly before the exam while advertising a "100% Paper Match" guarantee.

Across different Telegram groups, the wording changed slightly, but the underlying message remained consistent. Prospective buyers were encouraged to move away from public discussions and contact specific Telegram accounts directly, suggesting that negotiations and transactions were intended to take place privately rather than within the public groups where the advertisements were originally posted.

As additional identifiers were investigated, the campaign continued to expand into other Telegram communities, revealing that the advertisements were being circulated by multiple accounts rather than remaining confined to a single group or operator. This marked the first indication that the investigation was dealing with a broader promotional network rather than isolated attempts to exploit public interest surrounding the NEET controversy.

Raghav: A Campaign Across Communities

One of the earliest actors to emerge from the investigation operated under the display name "RAGHAV SIR." Raghav did not rely on a dedicated Telegram channel to promote alleged examination papers. Instead, the campaign was distributed across multiple Telegram communities, allowing the advertisements to reach audiences already engaged in underground trading and illicit services.

StealthMole identified two separate Telegram user IDs using the RAGHAV SIR branding. While both accounts shared similar naming conventions and promoted alleged RE-NEET examination papers using comparable messaging, the available evidence is insufficient to conclude whether they belonged to the same individual or represented multiple operators using a common identity. For this reason, they are treated as related identities operating under the same promotional persona.

Observed Telegram User IDs

• RAGHAV SIR: 8628584329
• RAGHAV SIR NEET: 8494718439

Raghav's activity was spread across existing Telegram communities, including PEER 2 PEER EXCHANGE and MJ Trusted Market. This approach significantly increased the visibility of the advertisements by placing them alongside other underground services rather than restricting them to a single audience.

The investigation also showed that alleged NEET paper leaks represented only one aspect of the account's activity. Messages attributed to the RAGHAV SIR branding advertised a variety of unrelated products and services, including gift cards, iPhone unlock codes, and financial offers. This broader activity suggests that the operator was already active within Telegram's underground trading ecosystem and incorporated examination-related fraud into an existing portfolio of illicit advertisements rather than creating a campaign dedicated solely to NEET.

This distinction is important. Instead of investing in dedicated infrastructure, Raghav appeared to rely on visibility within established underground communities, adapting promotional content according to demand. The approach required little infrastructure while providing access to audiences already familiar with illicit transactions, making Telegram groups an effective distribution channel for alleged examination paper advertisements.

Although Raghav's campaign demonstrated how existing underground communities could be leveraged to promote alleged paper leaks, another investigative pivot uncovered a markedly different approach. Rather than operating across multiple communities, a second actor had established a dedicated Telegram channel devoted almost entirely to marketing alleged NEET examination papers, signalling a more structured and persistent operation.

Abhishek: Building a Dedicated Marketplace

While Raghav's campaign relied on visibility across established Telegram communities, another investigative pivot revealed a more structured operation centred around a dedicated Telegram channel. Instead of promoting alleged examination papers within unrelated groups, the operator concentrated promotional activity within a single space, creating an environment focused almost entirely on attracting prospective NEET candidates.

The investigation identified the Telegram account @abhimishra0345, which repeatedly directed users towards a dedicated Telegram channel named "Neet Paper Leaked 🚀." Unlike the distributed promotional strategy observed earlier, this channel functioned as a central hub where advertisements, updates, and recruitment messages were published on a regular basis.

Telegram Account

• @abhimishra0345

Telegram Channel

• https://t.me/r***************d

Channel Name

• NEET Paper Leaked

Analysis of the channel showed that it was maintained as more than a simple advertisement board. Posts were published over an extended period, gradually building anticipation ahead of the examination. Rather than repeatedly sharing identical messages, the operator maintained an active campaign by announcing booking periods, reminding students of approaching deadlines, publishing updates for prospective buyers, and regularly encouraging users to contact the account directly.

One notable characteristic of the operation was its attempt to portray itself as an organised service rather than an anonymous seller. Alongside promotional posts advertising alleged examination papers, the operator published announcements relating to admissions, frequently responded to concerns about scams, and attempted to distinguish the channel from competing actors targeting NEET candidates. This consistent branding created the appearance of an established operation rather than a short-lived promotional campaign.

The investigation also revealed that the channel's activity remained highly focused on examination-related fraud. Unlike Raghav, whose advertisements appeared alongside a variety of unrelated underground services, Abhishek's operation revolved almost exclusively around NEET, allowing the channel to cultivate a dedicated audience interested in examination papers rather than general illicit trading.

This shift from distributed advertisements to a dedicated promotional channel marked an important evolution in the investigation. It suggested that while some actors leveraged existing underground marketplaces to reach potential buyers, others invested in maintaining their own infrastructure, giving them greater control over branding, messaging, and long-term engagement with prospective customers.

Manufacturing Credibility

Simply advertising alleged examination papers was not enough to convince prospective buyers. As the investigation progressed, it became evident that operators invested considerable effort in presenting themselves as credible and trustworthy, employing a range of psychological techniques designed to reduce hesitation and encourage students to engage privately.

One of the clearest examples was observed within the Neet Paper Leaked channel, where promotional messages were supplemented with screenshots presented as conversations with previous buyers. These posts portrayed individuals thanking the operator, claiming that the supplied papers matched the examination, and expressing satisfaction with the outcome.

Although the authenticity of these conversations could not be independently verified, they served an important purpose within the campaign. Rather than asking prospective buyers to rely solely on promotional claims, the operator attempted to create the appearance of a proven track record by showcasing what appeared to be successful transactions and satisfied customers.

Credibility was reinforced further through carefully staged promotional messages addressing common concerns raised by prospective buyers. Posts repeatedly assured students that the examination paper would be delivered before the exam, explained booking procedures, responded to questions regarding payment, and attempted to distinguish the channel from competing actors by warning users about scammers operating on Telegram.

The warnings about competing scammers were particularly noteworthy. Rather than discouraging participation altogether, the operator encouraged students to avoid "fake" sellers while portraying the channel as a reliable alternative. This approach positioned the operator as a trusted intermediary within an already crowded marketplace, allowing concerns about fraud to become part of the marketing strategy itself.

Another recurring tactic involved presenting the operation as an organised service rather than an anonymous transaction. References to booking windows, structured payment processes, and ongoing updates created the impression of an established operation with repeat customers and defined procedures. Whether genuine or fabricated, these elements worked together to reinforce the perception that prospective buyers were dealing with a long-standing service rather than a newly created Telegram account.

These findings suggest that the campaign relied on far more than bold claims about leaked examination papers. It systematically combined urgency, exclusivity, social proof, and anti-scam messaging to build credibility before attempting to convert interested students into paying customers.

What Historical Indexing Revealed

As the investigation progressed, attention shifted from the promotional campaign itself to the digital footprints left behind by its operators. One of the most valuable findings emerged when the Telegram account associated with the Neet Paper Leaked channel was revisited. By the time of the investigation, the account had already been deleted from Telegram, eliminating the profile that prospective buyers would have originally interacted with.

Ordinarily, the removal of an account would also erase much of the contextual information surrounding its activity. However, StealthMole's historical Telegram indexing preserved earlier snapshots of the profile, allowing the investigation to reconstruct details that were no longer publicly accessible.

Current Account Status

• Telegram Account: @abhimishra0345
• Current Status: Deleted

Historical Profile Information

• First Name: Abhishek
• Telegram ID: 5448350989

Historical Biography

• https://t.me/r*********************d

The historical profile data established a direct connection between the deleted account and the promotional channel previously identified during the investigation. While the live Telegram profile had disappeared, its earlier biography still contained a reference to the Neet Paper Leaked channel, strengthening the attribution between the operator and the campaign.

Historical indexing also preserved messages that were no longer easily discoverable through Telegram itself. These records showed that the account had actively promoted alleged examination papers across multiple Telegram communities, announced booking periods, published campaign updates, and encouraged prospective buyers to join the dedicated channel throughout the promotional period.

Rather than representing isolated remnants of deleted content, these historical artifacts enabled the investigation to reconstruct the evolution of the campaign after its public infrastructure had begun to disappear. This proved particularly valuable because it demonstrated that the removal of a Telegram account does not necessarily eliminate the surrounding intelligence. Historical records can continue to reveal relationships between accounts, channels, and promotional activity long after individual profiles have been removed from public view.

In this case, historical Telegram intelligence did more than recover deleted information. It helped preserve the operational context of the campaign, connecting a deleted operator profile to an active promotional channel and providing a more complete picture of how the alleged examination paper advertisements were organized and maintained over time.

Conclusion

What began as a simple search to determine whether the latest NEET paper leak controversy had generated activity within Telegram quickly developed into a much broader investigation. Rather than uncovering isolated advertisements, the investigation revealed a network of Telegram communities where alleged examination papers were repeatedly promoted using recurring marketing strategies, multiple operator identities, and carefully constructed credibility-building techniques.

The investigation identified two distinct operational approaches. One actor relied on established underground communities to distribute promotional messages across multiple groups, while another maintained a dedicated Telegram channel focused almost exclusively on attracting prospective NEET candidates. Although no evidence was found to confirm that genuine examination papers were ever obtained or distributed, the investigation documented a structured campaign that systematically exploited examination anxiety through urgency, scarcity, and social proof.

These findings demonstrate that Telegram continues to provide fertile ground for actors seeking to profit from high-profile examination controversies. More importantly, they illustrate how historical intelligence, behavioral analysis, and careful correlation of digital artifacts can transform scattered advertisements into a coherent picture of the infrastructure and tactics supporting such campaigns.

Editorial Note

Investigations involving online fraud and underground communities rarely produce complete or definitive attribution. Identities change, accounts disappear, and campaigns evolve rapidly. This case demonstrates how StealthMole's historical intelligence and artifact correlation capabilities enable analysts to reconstruct activity, uncover meaningful connections, and investigate evolving campaigns with greater confidence.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com