How to Investigate Discord Servers and Niche Forums (OSINT)

Block

04 · SOCMINT & Network Intelligence

Topic

SOCMINT

Tools

Telegram · TelegramDB · Telepathy · Telemetr.io · Telegago

Difficulty

Intermediate

Prerequisites

Wi-Fi positioning and geo-IP: locating by network data.

Closed platforms are not dark: they are structured data you have not yet extracted

Telegram channels, Discord servers and niche forums host primary-source material not found on indexed platforms. The challenge is not access, as much of this content is public by design, but structured extraction and network mapping without exposing your identity.

Telegram divides into two investigable layers. Public channels broadcast without subscription and public groups expose membership lists; both are indexed and searchable through third-party databases, with channel metadata, message history and forwarding networks recoverable without a Telegram account.

In the field

In April 2023, OCCRP and partner outlets traced leaked classified Pentagon documents from their origin in a private Discord server to publication on Telegram channels and 4chan, establishing the propagation path and the first public disclosure point through cross-platform timestamp and metadata analysis.

Channel network tracing. Reporters identified the Donbass Devushka Telegram channel as the first public Telegram publication point and traced propagation to linked channels using forward-chain analysis.
Cross-platform pivot. Post timestamps and URL structures correlated a 4chan /pol/ thread with the Telegram publication, sequencing the propagation path back toward the Discord origin.
Forum thread analysis. 4chan thread metadata anchored the timeline, confirming the Discord origin preceded Telegram and 4chan publications by weeks or months.

OCCRP and partner reporting · Pentagon document leak · April 2023

Learning outcomes

By the end of this tutorial you will be able to:

Extract channel metadata, member counts and admin identities from public Telegram channels without an active Telegram account
Map propagation networks by tracing forwarded messages across linked Telegram channels using TelegramDB and Telemetr.io
Recover public Discord server structure and visible membership data from invite links and archived sources
Document a platform investigation to evidentiary standard, with chain of custody records for each extracted artefact

The rest of this tutorial is for Signal subscribers.

What remains: the decision framework, the tool configuration, the failure modes, and the evidentiary standard required to use the finding defensibly. Signal is €90 a year, or €9 a month. Students, €49 a year.

Join Signal

A Signal subscription gives you:

Full OSINT Reference Card library, 21 domains
Methods, every tradecraft tutorial in full
AI in OSINT, every prompt and field report
Shadow Analysis, every forensic dossier

Discord and Niche Forum Investigation

Closed platforms are not dark: they are structured data you have not yet extracted

Learning outcomes

The rest of this tutorial is for Signal subscribers.

A Signal subscription gives you:

Keep Reading