Welcome back, aspiring cyberwarriors!
A lot of people believe that the widely-used social media site, Telegram, offers them anonymity to post confidential information. In this post, we will show you how you can find key information and de-anonymize users on Telegram.
Role in the Ukraine/Russia War
As one of the few social media platforms still available inside Russia and a key conduit for reporting from war-torn Ukraine, Telegram’s global profile has increased in recent years.
You can treat Telegram in any way you like, but it would be foolish to argue with the fact that it has carved out a niche for itself and that it’s very convenient to use. An the equally obvious fact is that Telegram is where a huge amount of information flows.
Those who control information control the world. While this might sound like a cliché, the Russian-Ukrainian war has demonstrated the profound importance of intelligence gathered through open sources (OSINT). Therefore, this article will demonstrate the basic techniques of searching for information in Telegram.
Telegram Identifiers
In Telegram, the names of users, bots, channels, and chat rooms are not permanent and can be changed as often as you like. Additionally, you can update your phone number at any time. However, to ensure clear identification, Telegram assigns a unique digital identifier called a Telegram ID when a user registers. Unlike names and phone numbers, this ID remains constant and cannot be changed.
The most common way to find someone’s Telegram ID is by using specialized bots. One of the most popular options is Telesint—simply send it a username, channel name, or chat name, and it will return the corresponding ID.
Thus, we have identified the type of account—in this case, a user—along with their ID, profile link, and username.
Some of these bots are Russian-speaking, but translation shouldn’t be an issue.
Occasionally, you might need to determine the creation date of an account. The easiest way to do this is by forwarding a message from the account in question to the CreationDateBot, which will provide the registration date.
Nickname
Telegram allows users to have two types of names, both of which are optional.
The first is the display name, formatted as a First Name / Last Name. This is what appears in contact lists and chats. You can enter anything here, as there are no uniqueness requirements. As a result, in most cases, it doesn’t serve as a reliable identifier. However, some users do enter their real names, making it somewhat useful depending on the context.
The second is the username, which starts with @. While it’s often referred to as a “nickname,” it functions as a unique link to the account. No two users can have the same username, but it can be changed at any time. This uniqueness allows for a simple way to check whether a username is in use—just save it in the Favorites folder in Telegram and try accessing it.
Alternatively, you can test a username by entering it as a link in your browser:https://t.me/USERNAME
If the link leads to the main Telegram website, the username is not in use.
If the username exists, it will display the user’s profile and offer to open it in the Telegram app or web version.
This method also applies to channels, chats, and bots, as they all use the same t.me link format.
Additionally, these links are indexed by Google, meaning you can search for them using Google’s site operator: site:t.me “query”
This method can also be used in reverse. If you come across a Telegram account with a unique username, you can try searching for the same username on social networks or other platforms.
For a quick check, you can simply Google it. If you need a more thorough search, https://whatsmyname.app allows you to look for matching usernames across multiple sites.
Telegram User De-anonymization
The first step in deanonymizing a Telegram user is simple but crucial: carefully examine the account and its content. The goal is not just to observe but to assess the uniqueness and usefulness of the published data for further analysis.
When analyzing a profile, consider the following elements:
Profile picture
Displayed name and surname
Username (@handle)
Bio or other details in the description
Before relying on any of this information, it’s essential to verify its authenticity.
How to Verify Account Information
If you have additional context from other sources that can be cross-referenced with the account data, start by comparing them. If not, each element should be examined independently and then analyzed in relation to the others. This process continues until you either find reliable information or recognize an attempt to mislead.
Example: Verifying a Profile Picture
Suppose the profile picture features a person. However, we cannot immediately assume it belongs to the account owner. To verify:
Perform a reverse image search to check if the photo appears elsewhere.
Identify whether it belongs to a real person or was taken from another source (e.g., a stock photo or another social media profile).
Look for clues in the background or surroundings.
If we know the user is supposedly from Paris and the background features Paris landmarks, this supports the image’s authenticity.
If the photo appears on unrelated accounts, it could indicate a fake or stolen identity.
Analyzing Other Account Details
The same approach applies to other profile elements. Cross-check usernames, descriptions, and shared content against external sources to detect inconsistencies or confirm legitimacy.
By systematically evaluating and correlating available data, you can determine whether the information is credible and useful for further investigation.
Bots in Telegram
Another quick and effective method is to check bots that aggregate leaked data from various sources. These bots can provide valuable information, but their availability is inconsistent—Telegram frequently removes them, only for new versions to reappear under different links.
Some of the most famous bots, known for their extensive databases, include:
OsintKit
Eye of God
Horus
User Activity Analysis
Analyzing profile details and bot data doesn’t always yield the desired results. Additionally, you might have a more specific goal beyond simple data collection. In such cases, it can be useful to identify the groups and chats a user is a member of.
This can provide valuable insights:
If someone participates in a city-based chat, they may have a connection to that location.
Interest-based groups can reveal hobbies, professional affiliations, or personal interests.
Understanding a user’s social circles can help establish contact or gain context for future interactions.
Beyond identifying groups, it’s equally important to analyze the user’s activity within them. Rather than scrolling through an entire chat, most Telegram clients allow you to search for all messages from a particular user. This can uncover valuable information, such as their communication style, opinions, or other identifying details.
How to Find a User’s Groups and Chats
Since Telegram doesn’t publicly list all group memberships, you’ll need third-party tools. However, high-quality results often require a small payment. Here are some options:
TelegramDB (also available as a bot)
Free search for groups by keywords and usernames.
Paid feature: Find groups where a user is or was a member.
Large and regularly updated database.
You can preview results before paying.
Paid-only service, but has a large and frequently updated database.
Shows the last time a user wrote in a group.
Free, but with a smaller database.
There’s no universal method for finding people on Telegram, but a systematic approach increases success rates.
Searching for Information in Telegram
Now that we’ve covered searching for people, let’s move on to another widely used method: searching for and collecting information in Telegram.
Defining the Goal
Before starting the search, it’s crucial to clearly define:
What information you need.
In what form it is likely to exist.
Using Telegram’s Built-in Search
Telegram’s built-in search often gets a bad reputation, but it isn’t entirely useless. While it’s not ideal for broad searches, it works well when looking for specific keywords within channels and groups you are subscribed to.
How to Effectively Use Built-in Search:
Identify relevant channels that might contain the information you need.
Subscribe to them and use keyword searches within those groups.
For better organization, consider using a separate Telegram account dedicated to each research topic. This way, you can subscribe to channels, conduct searches, and then clear the account for a fresh start on a new topic.
However, the major limitation of the built-in search is that it only works effectively when you already know which channels or groups to search in. If you’re searching blindly, the results can be highly random and unreliable.
Searching for Channels and Groups in Telegram
When it comes to searching and collecting information in Telegram, the key is often finding the right channels and groups where this information is shared. Once we know where to look, retrieving the data becomes much easier.
Since there are multiple ways to find relevant channels, let’s explore the most effective approaches.
Choosing the Right Search Method
The best approach depends on how familiar you are with the topic:
If you are unfamiliar with the subject and need to build a basic understanding, start by Googling relevant Telegram channels. For example, try searching: site:t.me/* (“SDR” OR “signal intelligence”)
In this context, we observe that all objects in Telegram are associated with a link in the format t.me/ followed by a unique set of characters. As such, we focus our search on objects that conform to this pattern. Additionally, we can specify any number of keywords or their combinations within brackets. This approach provides a generalized search method that helps us navigate the topic of interest.
There is another subtle point regarding links. Unique links are often used for inviting users to groups, chats, or channels. The uniqueness of these links allows us to track their public distribution by simply conducting an exact match search. These links follow the format https://t.me/+ followed by a random string of characters. To search for them, enclose everything after the plus sign in quotation marks and look for instances of its publication.
The search method described above can be loosely referred to as a “search for everything and everywhere” approach. It proves effective in two situations: when we’re searching for something highly unique or when we lack a clear direction and need to explore broadly. In all other cases, such as when we have a general idea of what we’re looking for, it’s more effective to narrow the search parameters.
At times, it can also be useful to search within channel names. Channel admins sometimes choose names that hint at the channel’s topic, which can be especially helpful when searching for themed groups. This approach is also effective when an admin forgets to set their corporate chat to private, which is not uncommon.
site:t.me/* intitle:osint
Telegram search engines
Another effective way to find content on Telegram is by using search engines specifically tailored for the platform. Currently, the best option for this is custom search engines based on Google CSE. One of the top choices is Telegago: https://cse.google.com/cse?&cx=006368593537057042503:efxu7xprihg
It searches through post content, titles, and descriptions, as well as channels, users, bots, and chats. Additionally, it can find articles published on telegra.ph and perform separate image searches.
Another option, while covering fewer sources, also delivers solid search results. In fact, its smaller scope can sometimes provide more precise results than Telegago. For the best outcome, it’s recommended to use both search engines: https://cse.google.com/cse?cx=004805129374225513871:p8lhfo0g3hg
It searches by channel names, descriptions, and post content, as well as user profiles and telegra.ph articles.
Additionally, an alternative search option is tgfind.org, which allows you to search for keywords within channel publications over a specified time period—sometimes proving to be a useful tool.
Telegram Channel Catalogs
When searching for channels or groups, all previously mentioned methods apply—Google, Telegram’s built-in search, specialized search engines, and more. However, an equally effective, and sometimes even superior, approach is using channel catalogs. These platforms not only help discover channels but also provide analytics, statistics, and other useful insights. Interestingly, they even track deleted posts from certain channels.
Originally designed for advertising and analytics, these tools also prove highly effective for OSINT purposes—and Telegram is no exception.
There are numerous channel catalogs available, but today we’ll explore: Telemetr.io
Standard search functionality allows searching by channel name—you don’t need an exact match, as it supports keyword-based searches.
Provides brief analytics for each found channel, with customizable display options.
Offers global searches or allows filtering by specific countries.
Below, you can find an analysis of the Telegram channel belonging to the hacker group “Solntsepyok,” which claimed responsibility for the cyberattack on KyivStar, a major Ukrainian telecommunications company.
Post Search on Telemetr.io
Searches for posts (even deleted) using keywords or phrases.
The free version only searches posts from the last 7 days.
Telegram Wayback Machine
Channel catalogs are useful, but they have limitations. For instance, if a channel gets deleted, its content might no longer be accessible. Additionally, catalogs don’t always save photos, and deleted videos may not be retrievable even if a post still appears in the archive.
However, there is a workaround—since 2022, the Wayback Machine has been archiving Telegram, just as it does with regular websites. It even has a dedicated collection for Telegram content: Wayback Machine – Telegram Collection
While not the most user-friendly tool, it’s often the only option for recovering lost content.
How to Search
Enter a keyword or phrase on the main page.
In the Collection Search section, select the Telegram collection and click search.
Expect thousands of results.
Each result may include the earliest and latest snapshots (if available) and a link to the original post.
If all else fails and you desperately need to find deleted Telegram content, digging through the Wayback Machine might be worth the effort. It’s a slow and tedious process, but sometimes, it’s the last resort that works.
Summary
I believe that, given all the information provided, it’s now clearer how and what you can find in Telegram. However, it’s important to understand that success depends on you—on how you apply these methods in a given situation. The outcome will be determined by which approach you choose, how you combine them, and most importantly, how you analyze the information you gather.
To improve your OSINT skills, check out our OSINT Investigator Bundle. You’ll explore both fundamental and advanced techniques and receive an OSINT Certified Investigator Voucher.
