Every Working Telegram Lookup Tool in One Place
Every Working Telegram Lookup Tool in One Place
One-Line Flow: Find who’s behind an account, what data leaked about them, and which groups they’re in. How? Phone number → permanent ID → leaked databases → cross-platform usernames → real identity. That’s it. That’s the whole game.
Why This Matters
Most “Telegram OSINT tips” circulating are dead techniques from 2021 that got patched years ago.
This separates what’s still breathing from what’s been buried — so you stop wasting time on recycled garbage.
Zero skills needed. Just know where to look and what buttons to press.
What’s Dead (Stop Using These)
People Nearby / Trilateration — RIP 2024
Remember that trick where you spoof GPS from 3 points and triangulate someone’s exact location?
Killed by Telegram after Durov’s arrest. Pavel personally announced it’s gone. The “People Nearby” feature no longer exists. Geogramint, Telegram Nearby Map — all of it is paperweights now.
You’ll still find tutorials about this everywhere. They’re all obsolete.
Phone Number URL Check (t.me/+PHONENUMBER)
The tip from the screenshot you showed me.
Reality: ~90% of users have “Who can find me by phone number” set to “My Contacts” or “Nobody.”
What you get now: "Sorry, there is no such user" almost every time.
Only works on accounts with weak privacy settings. Which is almost nobody who matters.
What Actually Works
The Permanent Anchor: User ID
Usernames change. Phone numbers change. Display names change.
User ID never changes. Assigned at registration, permanent forever.
This is your tracking anchor. Everything else is noise.
How to get it
- Forward any message from them to
@IDBot - Or use
@UserInfoBot,@Telesint - Telepathy tool does this programmatically
File Metadata (This Is The Real Shit)
Telegram STRIPS: Images (all EXIF/GPS gone) Telegram PRESERVES: PDF, DOCX, XLSX, MP4, MOV
PDFs and Word docs keep author names, “Last Modified By”, creation software, timestamps.
Run exiftool suspicious_file.pdf on anything shared in channels.
Why this matters
APT28 got attributed partly because their phishing docs had "Last Modified By: Сергей" in Cyrillic.
People upload docs thinking they’re safe. They’re not.
Forward Message Tracking
Every forwarded message carries metadata linking back to the original source.
This creates a graph. Channel A forwarded from B which forwarded from C.
Map disinformation networks. Find the original source. See who’s connected to who.
Tool for this
Telepathy by jordanwildon — creates edgelists automatically
telepathy -t channelname --forwards
Outputs CSV you can throw into Gephi for visualization.
Account Age Estimation
IDs are assigned roughly sequentially. Known ID/date pairs allow interpolation.
Use case: Detect sock puppets. New account pushing old narratives = suspicious.
Bots that do this
@creationdatebot@regdate_clone_bot
GitHub: karipov/creationDate
The Leak Bot Ecosystem
Russian/CIS Telegram has bots that aggregate breach data. Phone → email → social accounts → real name.
They get taken down constantly. They reappear under new names constantly.
Currently active (changes weekly)
| Bot | What it does |
|---|---|
@GetContactBot |
Russian TrueCaller. Names people saved your number as. |
@SocialMediaLeaksBOT |
Leaked social media data |
@karma_cybersec_bot |
Ukrainian. ID/name/phone/email lookup |
@ssb_russian_probiv_bot |
Russian “probiv” (lookup) |
@HowToFindRU_Robot |
Paid. Searches harvested leak datasets |
These bots require YOUR phone number to use. They now have it too. Use burners.
The Swiss Army Knife: Telepathy
Most serious practitioners use one tool: Telepathy (originally jordanwildon, now prose-intelligence-ltd)
What it does
- Archive entire chats (CSV + JSON + media)
- Scrape member lists (up to 5k visible)
- Map forward relationships between channels
- User activity analysis
- Location-based searches
- Handles rate limits gracefully (doesn’t lose data)
git clone https://github.com/prose-intelligence-ltd/Telepathy-Community.git
pip install -r requirements.txt
Requires Telegram API credentials from my.telegram.org (free) [/details]
Non-Obvious Insights
[details=“Things most guides don’t mention”] 1. Service messages are timeline markers “User X joined the group” = exact timestamps for activity reconstruction
2. Replies create partial subscriber lists Can’t see channel subscribers. BUT users who reply ARE visible. Partial enumeration through engagement.
3. Deleted content isn’t gone
- Telemetr.io indexes deleted posts (7 days, free tier)
- Wayback Machine archives Telegram since 2022
4. Aged accounts see more Fresh burner accounts get worse results. API returns different data based on account age/history. “Invisible” members become visible to accounts that have “seen” them before.
5. Same API key, multiple phone numbers = parallel scans Telepathy supports -a flag for alternative numbers.
Where Insiders Actually Operate
Channels worth following
@ibederov_en— Igor Bederov, active researcher@HowToFind/@HowToFind_RU— tips and links@CyberDetective— essential, EnglishИнтернет-Розыск— Russian OSINT newsУтечки информации— leak announcements
GitHub repos that stay updated
The-Osint-Toolbox/Telegram-OSINT— maintained post-Durov arrestItIsMeCall911/Awesome-Telegram-OSINTprose-intelligence-ltd/Telepathy-Communityrescenic/telegram-osint— includes regex analysis
Research orgs doing real work
- Molfar Intelligence Institute (Ukrainian)
- OS2INT (workflow articles at os2int.com/toolbox/)
- Bellingcat (phone checker tool on GitHub)
Quick Reference Workflows
Phone Number → Identity
1. Bellingcat Phone Checker → linked to Telegram?
2. If yes → @IDBot → get user ID
3. @creationdatebot → account age
4. @GetContactBot → what names people saved it as
5. @SocialMediaLeaksBOT → breach data
6. Cross-ref VK/Instagram via Russian bots
Username → Full Profile
1. @IDBot → permanent Telegram ID
2. Sherlock / WhatsMyName → same username elsewhere
3. Google: site:t.me "username"
4. TGStat / Telemetr.io → channel activity
5. Wayback Machine → archived content
6. Telepathy → if they're in accessible groups
Channel Investigation
1. telepathy -t channelname → basic scan
2. Archive with date range
3. --forwards flag → map connected channels
4. exiftool on any PDF/DOCX/video shared
5. Gephi → visualize network
OPSEC
- Burner phone for API registration
- Leak bots now have YOUR number
- Fresh accounts get worse results — age them
- Desktop app only for export functions
- True OSINT is passive. Don’t interact.
“The real signal lives in the metadata: the user who changed their username three times in a month, the forwarded message that links two seemingly unrelated scam groups, or the historic profile picture that reveals a face before the account went anon.”
The “private” messenger has more leaks than a submarine made of swiss cheese. Now you know where to look.
The tools are free. The bots are live. The rest is just clicking buttons.
Why Free Matters Here
!