Browser-Based Instant Messaging Apps OSINT Tips & Techniques
Telegram is a free cloud-based instant messaging service with over 550 million monthly active users. Telegram is available via web browser, mobile application, and desktop application.
- Selling stolen bank account credentials, hijacked accounts, or pre-KYC verified crypto exchange accounts.
- Selling breached data.
- Selling access to accounts, like streaming services and VPNs.
- Selling fake IDs and vaccination certificates.
- Selling tutorials for committing cyber-crimes.
- Extremist Propaganda
This article will show you how to conduct OSINT investigations using Telegram. We’ll discuss locating content to get the most value from Telegram for your OSINT investigations.
Telegram content can appear in several forms, which can be useful to an investigator when available.
Each Telegram user has a User Account, which is registered to a cell phone number, and a User ID. User’s can also create an optional username, which must be at least 5-characters long, and may consist only of a-z, 0–9, and underscores.
Telegram Groups are group messages that enable up to 200,000 members to correspond. Within Groups, users can share text, media, and links.
Normal Groups are private and can hold up to 200 members. Members are added by administrators or invite links.
Super Groups can have up to 200,000 members and can either be private or public. If public, any Telegram user can join the Group and in many cases, non-telegram users can access the messages within the Group.
When messages are sent within Group Chats, the name and profile photo of the sender are detailed.
Channels enable Telegram users to broadcast their public messages to large audiences. Through Channels, users can reach out to a broad network of people directly, sending a notification to their phones with each post.
Within Telegram Channels, only admins can post, so messages are essentially a one-way broadcast. There can be an unlimited amount of subscribers to receive the messages, however, non-admin members of Channels cannot reply or send messages within the Channel at any time.
Unlike Groups, Channels display the name and photo of the channel next to messages, rather than the person who posted them.
When viewing or subscribing to a Telegram Channel, users can see the entire message history back to the inception of the Channel. This is also the case with most Groups, however, this feature can be disabled by admins.
Bots are telegram tools that enable automation to be carried out within the Telegram platform. Like Users, Bots have a username, however, they need not be registered to a phone number. Bots carry out specific actions which have been configured by the bot builder via API.
Telegram K - https://web.telegram.org/k/
Telegram Z - https://web.telegram.org/z/
Legacy Version - https://web.telegram.org/?legacy=1#/im
Telegram has inbuilt search functionality to search for users, group chats, and channels. When searching for profiles within the Telegram platform, you can search for a user’s or a group’s name. Profiles with close name matches containing your search term will appear as suggestions.
Searching for a person’s name will bring back users, group chats, and channels.
Searching for a topic or name will bring relevant groups chats and channels.
Alternatively, group chats and channels can be found within Telegram using search engines. Using a Google search index, you can easily identify Telegram results within Google. Here’s how to get started:
By entering this simple command into a search engine, such as Google, you’ll tell the search engine to only show you web pages that come from the website www.t.me, the domain for Telegrams web application. The ‘site:’ operator removes pages from any other website from the search results. Whilst many pages are indexed, the results show only 2 results from t.me in Google’s index that load within the search window. Any search within the t.me domain currently returns only 2 results, so further operators must be specific.
By appending a topic in quotation marks to the end of our first query, we are narrowing down the search results to only those containing the required keywords. Again, only 2 results will populate, so the topic in quotation marks should be as specific as possible. An example of this would be:
BOsintBlanc’s Telegram CSE - https://cse.google.com/cse?cx=f22644e7cf7c34e97
An alternative to searching for Telegram webpages in Google’s core search capability is to utilize a Google Programmable Search Engine designed for Telegram. When using this search engine, more than 2 results will populate.
Telegago is another Google Custom Search Engine tool, which enables users to search Telegram and Telegram data aggregator sites for Users, Channels, and Groups.
Commentgram is a third Google Custom Search tool for Telegram, which searches comments in Telegram threads.
Having conducted a search, you will be able to discover relevant channels and group chats for investigation.
Channels with the t.me URL may show published messages without the need to be logged in to Telegram, such as https://t.me/s/Bankloadersofficial.
Within the Telegram application, the same group’s URL would appear as https://web.telegram.org/z/#-1397124044.
Public Group Chats with the t.me URL will not show published messages without the need to be logged in to Telegram and will show a page asking you to access the Group in Telegram, such as https://t.me/fraudnetworkcc.
Within the Telegram application, the same group’s URL would appear as https://web.telegram.org/z/#-1397124044, where the messages would appear.
Automating your Investigations on Telegram
Using a tool like Skopenow, you can automate the processes outlined in this guide to extract and analyze content from Telegram. Skopenow instantly and anonymously locates and archives social media accounts and posts, plots location history, flags actionable behaviors, and reveals hidden connections between individuals. Skopenow’s automatic report builder will save you time organizing the analyzed intelligence into a court-ready report. Please reach out to email@example.com or visit www.skopenow.com/demo to schedule a demo and activate a 7-day free trial for qualified businesses.