GDE-002 |
Telegram investigation | |||||||
Socmint | ||||||||
June 2026 | ||||||||
01
What it is
Telegram OSINT is the structured collection and analysis of intelligence from publicly accessible Telegram channels, groups, and user profiles using open-source methods, without accessing private communications or authenticating as someone other than yourself.
Telegram is a cloud-based messaging platform with over 1 billion users that operates a hybrid model: private encrypted chats sit alongside fully public broadcast channels and open groups, all accessible without an account. For investigators, the public layer is the primary target. Channels broadcast to unlimited subscribers and retain full message history. Public groups allow open membership and searchable content. Both are indexed, in part, by third-party tools and search engines.
Telegram OSINT differs from most social media investigation in three respects. First, Telegram does not use a central content index, so no single search surface covers everything. Second, the platform assigns each account a permanent numeric Telegram ID: a fixed integer generated at account creation that does not change when a username, display name, or phone number does. That ID persists across renames, account transfers, and channel rebranding, making it the only reliable anchor for any durable attribution chain. Usernames are mutable; the Telegram ID is not. Third, Telegram does not strip metadata from non-image file types. PDFs, Word documents, spreadsheets, and video files posted to channels retain their creation timestamps, author fields, and software version data. In investigations where a channel is distributing documents, that metadata is often more useful than anything visible on screen.
|
When to use this guide
|
02
How to run a Telegram OSINT investigation
A structured workflow for locating channels, extracting metadata, archiving content, and pivoting to linked accounts and networks.
The following tools are used across the steps below. All are free to access for basic use unless noted.
TGStat: Channel analytics and search platform indexing over 2.7 million public Telegram channels. Free tier provides subscriber counts, post history, citation index, and cross-channel mention tracking. Login required for advanced analytics. Free with registration.
Telegago: Google Custom Search Engine built by Bellingcat targeting t.me and telegram.me domains. Returns indexed public content without requiring a Telegram account. Free.
Telepathy: Open-source command-line toolkit for archiving Telegram chat history, extracting member lists (up to 5,000 members), mapping forwarded message networks, and retrieving account metadata. Developed by Jordan Wildon, now maintained under Prose Intelligence Ltd. Requires a Telegram API key from my.telegram.org and a personal account. Free. Technical setup required.
Wayback Machine: Internet Archive's web capture service. Used to check whether a Telegram channel page has been previously archived and to submit new captures before content is deleted. Accepts t.me URLs directly. Free.
WhatsMyName: Cross-platform username search tool that checks a given handle against hundreds of platforms simultaneously. Used in Step 04 to pivot from a Telegram username to linked accounts elsewhere. Free.
ExifTool: Command-line metadata extraction tool for reading embedded data from PDF, DOCX, XLSX, MP4, MOV, and other non-image file types. Used in Step 06 to extract authorship and timestamp metadata from documents posted to Telegram channels. Free, open source.
|
Before you begin Stop at the login. Most steps in this guide require no Telegram account. TGStat and Telegago work without authentication. Telepathy and Telegram Web require a personal account only when accessing content your research account has been added to. Do not create accounts under false identities or join private groups under pretences of membership you do not hold. Legal considerations. Collecting data from public Telegram channels is lawful in most jurisdictions, but processing personal data from member lists engages GDPR and equivalent frameworks. Minimise your data footprint: collect only what is necessary for your specific investigative purpose, and do not retain member list data beyond the active investigation period. Joining private groups under false pretences may constitute unauthorised access under applicable computer misuse law. |
Navigate to the channel via its t.me link. Record the username (the portion after t.me/), the display name, the description, the subscriber count, and the date of the first post if visible. Then take the username to TGStat and run a channel lookup. TGStat returns the numeric Telegram ID, citation index, subscriber growth history, and a list of channels that have forwarded or mentioned this one. Screenshot or export the TGStat page. The numeric Telegram ID and the first-post date are your two anchor identifiers.
Run the channel username through Telegago to retrieve Google-indexed posts, announcements, and any linked external URLs that have been posted in the channel. Telegago searches t.me and telegram.me domains, returning content that Telegram's own search does not expose. Supplement with a standard Google dork: site:t.me/[username]. Record every external URL found in posts, as these are pivot points to the operator's wider digital footprint.
In TGStat, open the Mentions tab for your target channel. This shows every channel that has forwarded or cited it, and every channel it has forwarded from. Channels that appear repeatedly in both directions are likely part of the same network or under common operational control. Export the mention list and plot the top nodes. A channel that forwards content to many others while receiving forwards from a small cluster is functioning as a distribution hub rather than an origination point.
Take the channel username and any admin or contact usernames visible in the channel description. Run each through WhatsMyName to identify accounts on other platforms using the same handle. Search the username verbatim on Google with and without the @ prefix. If the description includes an email address, a website, or a linked social media handle, each becomes a separate pivot. Catalogue every hit with a screenshot and its source URL.
For public channels, use the Wayback Machine to check whether the t.me channel page has been previously archived, and submit it for a new capture. For more systematic archival, Telepathy's comprehensive scan archives full message history, media, reactions, and forward counts to CSV and JSON. Run the scan from a dedicated research account, not your personal account. Hash the output files immediately after capture and record the hash alongside the capture timestamp. TGStat also retains historical subscriber growth and post reach data, which can be exported as a secondary record.
Telegram strips EXIF metadata from images at upload, but does not strip metadata from PDF, DOCX, XLSX, MP4, and MOV files. When Telepathy archives a channel with media enabled, download the non-image files and run ExifTool against them. Creation and edit timestamps, author fields, software versions, and timezone offsets are frequently present and can corroborate or contradict claimed authorship or origin.
|
03
What can go wrong in Telegram OSINT
Common attribution errors, data quality traps, and evidentiary pitfalls specific to Telegram investigations.
Username recycling: Telegram allows usernames to be changed and reassigned. A username that appeared in a 2022 archive may belong to a completely different account today. The numeric Telegram ID is the only stable identifier. Before attributing any username-linked finding, confirm the Telegram ID matches across sources and time points. Verifying check: Pull the current Telegram ID for the username from TGStat or Telegram Web and compare it against any previously recorded ID. A mismatch means the username has changed hands.
Subscriber count inflation: Telegram subscriber counts can be artificially inflated through bot networks and purchased followers. A high subscriber count is not evidence of genuine reach or influence. Verifying check: Review the TGStat subscriber growth chart. Organic growth is gradual and relatively smooth. Spikes of thousands of subscribers gained within hours, followed by flat or declining trends, indicate purchased or bot-generated followers.
Forwarded content misattribution: A channel that extensively forwards content from elsewhere is not necessarily the originating source. Forwarded posts retain the originating channel tag in the Telegram interface, but screenshots can obscure this. Verifying check: In the original Telegram channel or its TGStat citation data, identify the earliest appearance of the specific post. The channel with the lowest-numbered post ID for that content is the likely origin point.
Breach-derived tool results: Some Telegram OSINT tools and bots advertise the ability to look up phone numbers, passport data, or address information linked to Telegram accounts. These tools draw on leaked government databases and breach data. Results from such tools are not open-source intelligence in the defensible sense, may be illegal to use in many jurisdictions, and are frequently inaccurate. Verifying check: Any personal data claim about a Telegram user must be independently corroborated through a published public record, official registry, or on-platform disclosure before it can be included in an investigation file.
Chain of custody: Telegram content is volatile. Channels are deleted, made private, or have message histories cleared without warning, often in direct response to investigative attention.
Screenshot every relevant post at the point of discovery with the URL, channel name, and timestamp visible in the frame.
Submit the t.me channel URL to the Wayback Machine immediately and record the capture URL.
If Telepathy is configured, run the comprehensive archive to CSV/JSON and record the SHA-256 hash of each output file alongside the capture timestamp. If Telepathy is not set up, use Telegram's built-in Export Chat feature for accessible channels as an alternative.
Export the TGStat channel analytics page and record the export date.
Log every tool used, the query run, and the timestamp of the result in your case file.
04
Go deeper
Each reference card used in this guide is available individually in the archive. Every card covers the full workflow, key queries, OPSEC controls, false positives, and chain of custody requirements for the technique.
TEL-001
Phone number analysis and carrier lookup.
Twilio Lookup, PhoneInfoga, and Epieos. E.164 normalisation, carrier resolution, VoIP detection, and breach cross-reference. The natural follow-on when a Telegram investigation surfaces a linked number.
TEL-002
Trace a mobile number to a named subscriber identity.
HLR Lookup and OCCRP Aleph. From MSISDN to a graded attribution dossier via breach records and social pivots.
SOC-001
Social media account verification for investigators.
Botometer, Social Blade, and Wayback Machine. The corroboration layer for any cross-platform username pivot from a Telegram investigation.
GDE-004
How to verify a source: OSINT identity checks.
Applies when a source contacts you via Telegram and cross-platform identity checking includes the Telegram ID as an anchor identifier.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.