Introduction
Welcome back, dear readers! We are continuing our 'SHKH' series of articles, and today our main course is Telegram. In earlier articles, we looked at ways to find a target user's accounts by their nickname, after which we conducted reconnaissance on their account on the VKontakte social network. At this stage, our important goal is to find out the user's phone number, as the number can be a good starting point for reconnaissance and can reveal even more details about its owner. In the last article we tried to find out the number using a VKontakte page, and in this one, as you might have guessed from the title, we will try to find out as much information as possible about a Telegram account.
Disclaimer: All data provided in this article is taken from open sources. It does not call for action and is published solely for familiarization and study of the mechanisms of the technologies used.
Useful OSINT tools in Telegram (always working links) and great content.
Stage 1
Finding the User ID
As you might have guessed, in this article we will be working mainly with Telegram bots. Most bots ask for the user's unique identifier as input. It's quite simple to get it; let's look at two ways.
Official Telegram Desktop Client
Another simple way is by using the Telegram client on a PC. To do this, go to Settings --> Advanced --> Experimental settings --> Show Peer IDs in Profile.
Now, for convenience, we can immediately see the ID of every user in their profile.
BGram Android
A modification of the Telegram client for Android in which this function is already built-in by default.
Stage 2
Finding various information about the user using bots
Insight
The best freemium bot for Telegram account reconnaissance. It determines the owner's hobbies, possible location, and many, many other interesting things. You can see one of the striking examples below.
It's a pretty good bot for gathering a general profile of a target person. The currency for searching is quite easy to obtain; the bot itself will occasionally drop a little currency into your account. Again, it all depends on how often you use it and how many accounts you have.
fun-stat-bot
Another cool bot for collecting general information about a target user. Like the previous bot, it gathers the user's interests based on the communities they are a part of. It can provide past account names, and what's also very interesting is that it can show the user's messages in public chats, even if they were previously deleted by the user.
Here, we are greeted by many options after we have entered the target account's ID. Let's quickly review all the available options. But don't get too excited at first, as all options are unlocked with the bot's currency, 'knowledge crystals.' The bot generously shares this currency with you on your first visit, giving you a whole 20 crystals. The currency can also accumulate on its own in small amounts and during bot updates.
The first option is the profile, which provides information about how active the account is in general. Based on this, you can conclude whether it is a primary account or not. Additionally, there might be extra names and tags, which means new nicknames you can use to start a search from scratch.
In the "Acquaintances" section, we can see who the user replies to most often, in public chats of course, and logically figure out who the user knows.
In the 'analysis' section, the bot analyzes the content of messages and, based on this content, makes assumptions about likes, age, phone number, and so on. However, it sometimes provides incorrect output; for example, it considered this message as 'age'.
We really like the 'Chats' section, as it shows in maximum detail which chats the user is/was a member of.
A very detailed section is 'Messages'. Here, just like in VKontakte chat attachments, we can view pictures, videos, links, and other types of messages sent by the user, or we can simply view them all.
Tags and usernames can also be extremely useful.
A very curious feature is tracking the user and their online activity, which can be very useful.
TeleSINT
Another bot, which determines which chats a user is in. I don't have much to add, as we use it to try to extract any possible new information.
Stage 3
Finding the phone number
Well, the most important stage has arrived: the search for the phone number, which will be our key to many other pieces of data about the target user. Unfortunately, this section will only feature two bots, as in our experience, these are the only free and freemium bots with which we have been able to effectively find account phone numbers.
Telegram Analyst
A completely free bot with a small database of Telegram accounts. It rarely provides anything useful, but sometimes you can get lucky.
This bot has a very specific way of populating its database: using trap bots. Unfortunately, I can't provide an up-to-date list of them, but we think it won't be difficult to find them on several thematic channels.
Unamer
And for dessert, another wonderful and functional bot, which can provide the account's name history and, with some probability, the phone number. Unfortunately, it's not as generous with its internal currency as the previous bots, but it also doesn't spend it if no information is found. If we consider the free usage option, it's a one-time use, or you'll have to wait several centuries for a bonus to drop. If you consider the paid option, 11 tokens are equivalent to $10. We have written more about the functionality of this bot here.
Conclusion
We hope that the bots we've shared in this article will help in investigations and in building the experience of enthusiasts. Of course, almost every one of these bots is freemium, and it would be much more effective to use the paid versions. We readily agree with this, but you must also agree that people who are successful in the OSINT field don't need any guides or reviews for the paid versions of bots.
Useful OSINT tools in Telegram (always working links) and great content.