OSINT in Telegram.

[Fixxx]

Many believe that Telegram ensures complete anonymity when publishing confidential information.
However, in reality, Telegram is frequently used for collecting open data and de-anonymizing users.

Methods for Searching in Telegram​

• Examining Public Channels and Groups
• Searching for Messages and Users by Keywords
• Utilizing Bots and Special Tools for Data Collection
• Verifying Information from Other Open Sources

OSINT enables effective identification and analysis of crucial information and the identification of Telegram users.

Unique Identifiers in Telegram​

In Telegram, usernames, bots, channels, chats and phone numbers are not permanent and can change at any time. For unambiguous identification, each user is assigned a unique digital identifier: Telegram ID. Unlike names and numbers, this ID is immutable and serves as a permanent identifier. The most common way to obtain a Telegram ID is by using specialized bots. For example, the Telesint bot allows you to get the corresponding Telegram ID by username, channel name or chat name. To do this, simply send the bot the desired nickname or name and it will return the unique digital identifier. Thus, we have determined the type of account (in this case, a user ) along with their ID, profile link and name. Sometimes it may be necessary to find out the account creation date. The simplest way is to forward a message from the desired account to the CreationDateBot bot, which will return the registration date.

​

Usernames in Telegram​

In Telegram, users can have two types of names, both of which are optional. Display Name - Name / Surname. It's displayed in contact lists and chats. Here you can specify any data, uniqueness is not required, so in most cases, this is not a reliable identifier. However, some use real names, which can be useful in certain contexts. Username starts with @ and is often called a "nickname". but it's actually a unique link to the account. Two users cannot have the same username, but it can be changed at any time. Uniqueness allows easy verification of name availability. Another way to check is to go to the link: https://t.me/USERNAME

• If the Telegram homepage opens, the username is free.
• If the account exists, its profile opens with an offer to open it in the app or via the web version.

Similarly, checking works for channels, chats and bots, as they use the same link format t.me. These links are indexed by Google, so searching for them is possible through the operator site:t.me "query".

This method can also be used in reverse. If you encounter a Telegram account with a unique username, try finding the same username on other social networks and platforms. For quick verification, you can simply google it. For a more thorough search, use whatsmyname.app - the service searches for matching usernames on numerous sites.

​

De-anonymizing a Telegram User​

The first step in de-anonymizing a Telegram user is simple but critical: carefully study the account and its content. The goal is to assess the uniqueness and usefulness of the published data for further analysis. When analyzing the profile, consider the following elements:

• Avatar
• Display Name and Surname
• Username (@handle)
• Biography and Other Details in the Description

Before relying on this information, it's important to verify its authenticity.

​

Verifying Account Information​

If you have additional context from other sources that can be compared with the account data, start with the comparison. If there is no context, each element should be investigated separately and then the relationships should be analyzed. The process continues until you obtain reliable information or detect an attempt to mislead. Assume the avatar shows a person. You cannot immediately believe that this is the account owner. To verify, perform:

• Reverse image search to see if the photo appears elsewhere
• Determine if the photo belongs to a real person or is taken from another source
• Look for clues in the background or surroundings
• If it's known that the user is supposedly from Paris and Paris landmarks are visible in the background, this confirms the authenticity of the image
• If the photo appears on unrelated accounts, this may indicate a fake or stolen identity.

​

Analyzing Other Account Details​

The same methodology applies to other profile elements. Cross-reference usernames, descriptions and published content with external sources to detect discrepancies or confirm correspondence. By systematically evaluating and correlating available data, you can determine how reliable the information is.

​

Bots in Telegram​

Another quick and effective method is to check bots that aggregate leaked data from various sources. These bots can provide valuable information, but their availability is not constant - Telegram regularly removes them, after which new versions appear at different links. Some of this links you can find here.

​

Analyzing User Activity​

Analyzing profile details and bot data doesn't always yield the desired results. Additionally, you may have a more specific goal than just data collection. In such cases, it's useful to determine the groups and chats of which the user is a member. This provides valuable information:

• Participation in a city chat may indicate a connection to that place
• Thematic groups reveal hobbies, professional affiliation, or personal interests
• Understanding the social circle helps establish contact or obtain context for further interaction

In addition to identifying groups, it's important to analyze the user's activity in them. Instead of scrolling through the entire chat, most Telegram clients allow you to search for all messages from a specific user. This can reveal important information such as communication style, opinion or other identifying details.

​

Finding a User's Groups and Chats​

Since Telegram doesn't publish a complete list of group members, third-party tools are needed. Quality results often require a small payment. Here are some options:

TelegramDB (also available as a bot)​

• Free search for groups by keywords and usernames
• Paid feature: search for groups where the user is or was a member
• Large and regularly updated database
• Ability to preview results before payment

TGScan​

• Only a paid service, but with a large and frequently updated database
• Shows the time of the user's last message in the group

Where a Person Wrote Bot​

• Free, but with a smaller database

There is no universal method for finding people in Telegram, but a systematic approach increases the likelihood of success.

Searching for Information in Telegram​

Now that we have discussed finding people, let's move on to another common method - searching for and collecting information in Telegram.

​

Defining the Goal​

Before starting the search, it's important to clearly define:

• what specific data is needed
• in what form it's likely to exist

Understanding the ultimate goal allows you to create an effective search strategy. Defining the most likely sources allows you to choose appropriate methods.

Built-in Telegram Search​

The built-in Telegram search is often criticized, but it's not useless. For broad queries, it's ineffective, but it works well for searching specific keywords in channels and groups you are subscribed to. How to effectively use built-in search:

• Determine relevant channels where the needed information might be located
• Subscribe to them and perform keyword searches within these groups
• For convenience, create a separate Telegram account for each research topic

The main limitation is that it's only effective if you already know which channels or groups to search in; in blind searches the results may be random and unreliable.

​

Searching for Channels and Groups in Telegram​

The key to collecting information in Telegram is to find the relevant channels and groups where this information is published. Once we know where to look, extracting data becomes much easier. There are several ways to find relevant communities; below is a selection of the most effective approaches.

​

Choosing a Search Method​

The approach depends on your familiarity with the topic. If the topic is unfamiliar and you need to form a basic understanding, start by searching for relevant channels through Google. For example: site:t.me/* (“SDR” OR “signal intelligence”). In Telegram, all objects are linked with a link in the format t.me/ + a unique set of characters. Therefore, focus the search on objects matching this pattern, specifying any number of keywords or their combinations in parentheses. This approach is suitable for navigating the topic of interest. Another point regarding links. For invitations to groups, chats or channels, unique links are often used. Their uniqueness allows tracking public distribution. Such links have the format https://t.me/+<random_string>. To search, take everything after the plus sign in quotes and search for publications with an exact match. The described method can be called "search everywhere". It's effective in two cases: when searching for something very unique or when there is no clear direction and broad reconnaissance is needed. In all other cases, for example, when there is a general understanding of the subject, it's more effective to narrow the search parameters. Sometimes it's useful to search by channel names. Admins of channels sometimes give names that reflect the topic, which helps in searching for thematic communities. This trick also works if the admin forgot to make the corporate chat private (not uncommon). Example search query: site:t.me/* intitle:оsint

As shown in the example, use the intitle operator with a term that potentially may be present in the channel or chat name. This could be a keyword related to the channel's topic or, if searching for a company's channel, the company's name.

​

Specialized Search Engines for Telegram​

Another effective way to find content in Telegram is to use specially configured search engines. Currently, the best option is custom search engines based on Google CSE. One of the top options is Telegago. It searches by the content of posts, titles and channel descriptions, user profiles, bots and chats. Additionally, it can find articles published on telegra.ph and perform a separate image search.

Another option, covering fewer sources, also provides quality search results (in fact, a smaller scope sometimes provides more accurate results). For the best results, it's recommended to use both search engines.

It searches by channel names, descriptions and post content, as well as user profiles and articles on telegra.ph. Additionally, an alternative search option is tgfind.org, which allows searching for keywords in channel publications over a specified period.

​

Telegram Channel Directories​

When searching for channels or groups, all previously mentioned methods (Google, built-in Telegram search, specialized search engines, etc) are applicable. However, an equally effective and sometimes superior, approach is using channel directories. These platforms not only help find channels but also provide analytics, statistics and other useful data. Interestingly, they even track deleted posts. Originally intended for advertising and analytics, these tools also prove to be highly effective for OSINT tasks. There are many channel directories, but now we will look at Telemetr.io.

• The standard search function allows searching by channel name - exact match is not required, keyword search is supported.
• Provides brief analytics for each found channel with customizable display options.
• Supports global search or filtering by specific countries.

Searching for posts on Telemetr.io:

• Searches for posts (including deleted ones) by keywords or phrases.
• The free version indexes only posts from the last 7 days.

​

Telegram Wayback Machine​

Channel directories are useful but limited: when a channel is deleted, the content may become inaccessible and directories don't always save photos and videos. Since 2022, the Wayback Machine has been archiving Telegram. The tool is not the most convenient, but it's often the only option for recovering lost content. How to search:

1. Enter a keyword or phrase on the homepage.
2. In the Collection Search section, select the Telegram collection and click search.
3. Wait for thousands of results.
4. Each result may contain screenshots and a link to the original post.

This is a slow and tedious process, but sometimes this resource is the last resort.

Conclusion​

Success depends on you - on how you apply these methods in a specific situation. The result is determined by the chosen approach, the combination of methods and, most importantly, how you analyze the collected data.