Telegram OSINT: what is public, what the tools reach, and what survives deletion.

Last verified: 9 September 2026. Telegram is two networks wearing one app. The public network is made of channels and groups whose posts anyone can read without an account: open t.me/s/channelname in a browser and the last messages render as plain web pages. The private network is everything else, which is to say one-to-one chats, private groups, secret chats and the identity behind an account. Telegram OSINT lives almost entirely on the public side, and the honest first step of any investigation is deciding which side your target is on.

Three identifiers matter. A username (the @handle) is optional, changeable and reusable: when someone drops a handle, anyone can claim it, so a handle found in a two-year-old post may now belong to a stranger. A user ID is a permanent integer assigned at account creation; it never changes, it is not shown in the app, and bots reveal it. A phone number is the account's true anchor, and whether a number resolves to a profile depends on the target's privacy settings, not on the investigator's tooling. Telegram passed one billion monthly active users in March 2025, so the public side alone is a large field.

Username search works when the handle is public. Typing t.me/handle into a browser shows whether the handle belongs to a user, a channel, a group or a bot, with the display name and bio. For users this is the whole public surface: no message history, no join list. For channels and groups it opens the web preview, which is where most Telegram OSINT actually happens.

User ID lookup is the reverse problem and Telegram gives you no native tool for it. The practical route is a bot: forward a message from the target to an info bot such as @userinfobot-style services and it returns the numeric ID, or add a bot to a group you control and read the IDs it logs. Once you hold the ID you can watch a target across username changes, because the ID is the only thing that does not move. Cross-platform checkers such as footprintiq.app, which we tested on 9 September 2026, take a handle and look for the same string on other services; useful for pivoting, useless for anything inside Telegram.

Phone number lookup is the method people ask about most and it is the most constrained. Save the number to your contacts and Telegram will show a profile only if the owner has left "who can find me by my number" open. Bellingcat's telegram-phone-number-checker on GitHub automates exactly that check and nothing more. There is no lawful shortcut past a target's privacy setting.

We ran every tool below on 9 September 2026 and recorded what it returned. The verdicts are about fit, not popularity: a catalogue is not a search engine, and a search engine is not an archive.

The pattern across the table: the public channel layer is well served by search engines, nothing covers private groups, and no tool promises retention of what a channel admin deleted. For the search engines themselves, ranked and tested, see the Telegram search engine comparison.

A large share of the demand behind "telegram osint bot" is people looking for leak lookup bots: services that take a phone number, a plate or a name and return rows from stolen databases. They are not open source intelligence. The data was never public, the bots sit outside any legal basis an investigator can cite, and the results cannot be produced in evidence without explaining where they came from. Several have been shut down by their own hosts; the rest churn handles every few weeks.

The line that matters for a professional is simple: OSINT works from information that was lawfully public at the moment it was collected. A channel post, a group description, a public username, an archived copy of a page that anyone could read: all of these qualify. A breach dump does not, however convenient the bot. If your case needs subscriber data, the route is a lawful request to Telegram, which we cover below.

Telegram deletes hard. A user can delete any message they sent or received in a one-to-one chat for both sides, at any time, with no time limit since March 2019. In groups a member can delete their own messages; admins can delete anyone's. A deleted message is gone from Telegram's cloud for every participant, and Telegram's FAQ states it has disclosed zero bytes of user messages to third parties. Nothing inside Telegram brings a deleted message back.

What survives is what left the platform before the deletion: a forward into another channel, a screenshot, a search engine's copy of a public channel page, or an archive that captured the post while it was public. Channel posts sit on the public web at t.me/s/channelname, which is why third-party indexers can hold copies of posts an admin later removed; nothing guarantees they will, but the copies exist more often than people expect.

"Deleted Account" is the label Telegram puts on messages from an account that no longer exists. The account owner deleted it (or it self-destructed after the default 18 months of inactivity), the profile was wiped, and the name in old group history was replaced. The messages themselves stay in the group. For an investigator that is a clue rather than a dead end: the user ID behind the label is still the ID that posted, and a bot that logged it before the deletion still has it.

In September 2024 Telegram rewrote section 8.3 of its privacy policy. It now states that if Telegram receives a valid order from the relevant judicial authorities confirming a user is a suspect in a case involving criminal activity that violates the Telegram Terms of Service, it may disclose that user's IP address and phone number. Before the change the policy limited disclosure to terrorism cases; until 30 September 2024 Telegram had fulfilled 14 such requests affecting 108 users. The first quarter of 2025 alone covered 22,777 users.

Two details in the same policy matter more day to day. Metadata such as IP addresses, device details and username change history is kept for a maximum of 12 months, so a preservation request has a clock on it. And account deletion, whether voluntary or by the inactivity rule, removes all cloud data, which means the lawful route only works while the account exists. Neither route returns message content: that stays out of reach on both the OSINT side and the legal side.

The most productive Telegram pivots often start somewhere else, and the somewhere else is usually Reddit. Communities pin their Telegram groups in AutoModerator comments, promoters drop t.me links under posts, scam warnings quote the handle that made the approach. In THINKPOL's archive, Reddit posts and comments mentioning "telegram" peaked at 14.1 million in 2024, after 3.8 million in 2022, and stood at 5.2 million for 2026 to date. On 9 September 2026 the large majority of the fifty most recent comments containing a t.me/ link were AutoModerator boilerplate pointing members to a community's Telegram group, including backup channels for NSFW and piracy subreddits.

That pattern is the investigator's advantage: when a subreddit is banned, its migration path to Telegram is already in the archive, in posts the live site no longer shows. Run the handle or the invite link through the free archive search, then pivot on the Reddit accounts that posted it with the user lookup. The full worked example of a banned community respawning off-platform is in our SoccerStreams investigation, and the method behind it in the Reddit OSINT guide.

THINKPOL does not archive Telegram. It archives Reddit: 30 billion posts and comments since 2005, captured at publication, including content later deleted or removed, searchable in under 300 milliseconds from EU infrastructure. For Telegram work that means the Reddit side of the trail: invite links, handles and IDs posted on Reddit, including in deleted posts and banned subreddits, plus the Reddit accounts that share them. Native Telegram coverage is the next platform on THINKPOL's roadmap, with Discord, Mastodon/Fediverse and Instagram behind it.

The free tools need no account. For the wider toolkit and where Telegram sits in it, see the OSINT landscape and the grey web intelligence page.