Understanding Telegram's Architecture
Telegram uses a custom MTProto protocol with multiple data centers worldwide.
- Telegram exposes two API levels: the Bot API (limited, public-facing) and the MTProto Client API (full access, requires
api_id/api_hashfrom my.telegram.org) - User IDs are permanent numeric identifiers , even if someone changes their username, their ID stays the same
- Telegram uses “snowflake-like” IDs that encode creation timestamps, which can be used to estimate when an account or channel was created
Phone Number to Account Resolution
Telegram accounts are tied to phone numbers, which allows you to resolve a number to a profile.
- Using the MTProto API (via the Telethon library), you can import a phone number as a contact and resolve it to a Telegram user
- This reveals: user ID, username, first/last name, profile photo, online status, and bio
- Rate limits are aggressive: approximately 20 lookups per minute before a
FloodWaitErroris triggered - Privacy settings can limit what is visible (last seen, profile photo, phone number, forwarded messages)
Channel and Group Intelligence
Public channels and groups can be found by name, and their full message history is accessible.
- Channel metadata: subscriber count, creation date, description, and admin list (if visible)
- Message analysis: forwarded messages reveal source channels, creating a network graph of information flow
- Media analysis: shared images may contain EXIF data (GPS coordinates, camera info)
- User lists: group participant lists reveal who belongs to which communities, enabling cross-group correlation
Username OSINT
Telegram usernames are unique and can be searched on t.me/{username}. This public page reveals display name, profile photo, bio, and subscriber/member count.
- Username history: Telegram allows changing usernames, but old usernames become available again , monitoring these changes can reveal identity shifts
- Cross-platform correlation: the same username on Telegram and other platforms often belongs to the same person
- Fragment.com: Telegram's username marketplace where premium usernames are auctioned , this can reveal ownership transfers and financial connections
Bot Analysis
Bots have usernames ending in “bot” and can be analyzed for information about their operators.
- Bot source code and behavior can reveal information about their operators and infrastructure
- Bot API tokens (if leaked) expose the bot owner's user ID , always search for leaked tokens in code repositories
- Inline bots can be probed for information about their backends and the services they connect to
OSINT Tools for Telegram
Here are some useful tools and resources for Telegram OSINT investigations:
