Listen to this Post
Introduction:
In the realm of cyber threat intelligence and digital investigations, Open-Source Intelligence (OSINT) is a critical skill. A single data point, like a phone number, can be the key to unlocking a target’s entire digital footprint. This article explores a fundamental yet powerful technique for linking phone numbers to Telegram accounts and expands into a comprehensive methodology for cross-platform pivoting, providing security professionals with verified commands and a structured approach.
Learning Objectives:
- Master the technique of querying Telegram’s API for phone number association.
- Learn to automate and scale OSINT data collection using command-line tools.
- Understand and implement advanced pivoting strategies across multiple platforms and data sources.
You Should Know:
1. The Foundational Telegram Phone Number Check
This is the core technique as highlighted in the source post. It leverages a legitimate feature of Telegram’s user discovery system. By constructing a specific URL, an investigator can quickly determine if a phone number is associated with a public Telegram account, provided the account’s privacy settings permit discovery by phone number.
` Manual Browser Check`
` Simply enter this URL into your browser’s address bar, replacing [bash] and [bash] accordingly.`
`t.me/+[bash][phone_number]`
` Example for a US number:`
`t.me/+15558675309`
Step-by-step guide:
- Obtain the Target Phone Number: Ensure you have the number in E.164 format (e.g., +33612345678 for France, +15558675309 for the US).
- Construct the URL: Open a new browser tab and type `t.me/+` followed by the full phone number, without any spaces, dashes, or parentheses.
3. Analyze the Result:
If a Telegram profile appears, the number is linked to an account, and the user has not restricted discovery via phone number.
If a “Sorry, this user doesn’t seem to exist” message appears, either the number is not on Telegram, or the user has disabled the “Phone Number” privacy setting.
2. Automating the Check with cURL
Manually checking numbers is inefficient for large-scale investigations. Using cURL, a powerful command-line tool for transferring data, you can automate this process from a terminal, enabling batch testing and integration into larger OSINT pipelines.
` Linux/macOS/PowerShell (Windows)`
` Basic cURL request to check a number. The ‘-I’ flag fetches headers only, making it fast.`
`curl -I “https://t.me/+15558675309″`
` A more useful command that follows redirects (-L) and shows the final URL, which often reveals the username.`
`curl -L –no-progress-meter “https://t.me/+15558675309” | grep -oP ‘tgme_username_link”[^>]>@\K[^<]' || echo "Profile Not Found"`
Step-by-step guide:
- Open Your Terminal: Access your command-line interface (Command Prompt, PowerShell, or Bash).
- Run the cURL Command: Input the command, replacing the phone number with your target. The `-L` flag tells cURL to follow redirects, as Telegram will redirect the phone number URL to the user’s actual profile page.
- Interpret the Output: The command will output the HTML of the profile page. Piping it to `grep` searches for the username. If a username is found, it will be displayed. If not, “Profile Not Found” is printed, indicating a negative result.
-
Advanced Pivoting: From Telegram to Usernames and Beyond
A successful phone number lookup on Telegram provides a new pivot point: the Telegram username. This unique identifier can be searched across the internet to find associated accounts on other platforms, a technique known as cross-platform pivoting.` Using Sherlock (A powerful OSINT tool for username enumeration)`
` First, install Sherlock using pip.`
`pip3 install sherlock-project`
` Then, use it to hunt for the username across hundreds of sites.`
`sherlock [bash]`
` Example:`
`sherlock johndoe123`
Step-by-step guide:
- Install Sherlock: Ensure you have Python and pip installed, then run the installation command in your terminal.
- Run the Search: Execute the `sherlock` command followed by the Telegram username you discovered.
- Analyze the Report: Sherlock will output a list of platforms (like Twitter, Instagram, GitHub) where the username was found, along with the full profile URLs. Each of these is a new investigative lead.
4. Leveraging Breach Data for Enhanced Context
Phone numbers and email addresses are often exposed in data breaches. Querying these can reveal passwords (which should be used ethically and legally, primarily for credential stuffing awareness), associated IP addresses, and other personal data that can enrich an investigation.
` Using H8mail (An email and phone number breach hunting tool)`
` Install H8mail.`
`pip3 install h8mail`
` Run it against a target phone number or email.`
`h8mail -t “+15558675309” -bc path/to/your/breach_compilation/folder/`
Step-by-step guide:
- Acquire Breach Data: This step requires access to breach compilations (e.g., from services like DeHashed or via torrents of collections like COMB). Ensure you have the legal right to access and use this data for your investigation.
- Configure and Run H8mail: Point the `-bc` flag to your local breach database. The tool will rapidly search through terabytes of data.
- Correlate Findings: Use discovered email addresses, passwords, or usernames to pivot back to other social media and service logins.
5. Defensive Posture: Hardening Your Own Telegram Privacy
From a defensive cybersecurity perspective, understanding this technique is key to protecting your own and your organization’s digital footprint. Locking down privacy settings is a critical mitigation.
` There is no command for this; it is a manual configuration process.`
` Steps to disable discovery by phone number on Telegram:`
` 1. Open Telegram Settings -> Privacy and Security -> Phone Number.`
` 2. Set “Who can see my phone number?” to “Nobody”.`
` 3. Set “Who can find me by my number?” to “My Contacts”.`
Step-by-step guide:
- Navigate to the Settings menu in your Telegram application.
2. Select Privacy and Security.
3. Click on Phone Number.
- Set “Who can see my phone number?” to “Nobody”.
- Set “Who can find me by my number?” to “My Contacts”.
This ensures that only people already in your device’s contact list can link your number to your Telegram account.
6. Building an OSINT Automation Script
Combining these techniques into a single script can dramatically increase efficiency. Below is a conceptual Bash script outline that automates the initial discovery and pivoting.
`!/bin/bash`
` Basic OSINT Pivot Script`
`echo “Enter Phone Number (E.164 format):”`
`read phone`
`echo “Checking Telegram for $phone…”`
`username=$(curl -L –no-progress-meter “https://t.me/$phone” 2>/dev/null | grep -oP ‘tgme_username_link”[^>]>@\K[^<]')`
`if [ ! -z “$username” ]; then`
` echo “[+] Found Telegram username: $username”`
` echo “[+] Launching Sherlock scan…”`
` sherlock $username`
`else`
` echo “[-] No public Telegram profile found.”`
`fi`
Step-by-step guide:
- Create the Script: Save the above code into a file, e.g.,
osint_pivot.sh.
2. Make it Executable: Run `chmod +x osint_pivot.sh`.
- Run the Script: Execute it with `./osint_pivot.sh` and input the target phone number when prompted.
- Review Output: The script will automatically check Telegram and, upon finding a username, launch a Sherlock scan to find other social media accounts.
What Undercode Say:
- The line between a platform feature and an OSINT vulnerability is perpetually thin. Techniques like the Telegram phone number lookup are a testament to how default privacy settings are the primary attack surface for digital reconnaissance.
- The future of defense lies not in total obscurity but in operational awareness and disciplined operational security (OPSEC), where individuals and organizations consciously manage their public and semi-public data.
The technique described is not an exploit but a deliberate design choice by Telegram, highlighting a core principle in cybersecurity: availability of information is a double-edged sword. For defenders and ethical investigators, this is a powerful tool for threat hunting and attribution. For malicious actors, it’s a low-effort entry point. The mitigation is simple and entirely in the hands of the user, yet widespread adoption of strong privacy settings remains low. This creates a persistent and rich ecosystem for OSINT practitioners. The evolution of such techniques will continue to be a cat-and-mouse game between platform policy, user education, and the investigative community’s ingenuity.
Prediction:
As public awareness of these simple lookup techniques grows, we will see a significant increase in users tightening their privacy settings on platforms like Telegram. This will force a shift in the OSINT landscape towards more advanced methods, including the automated correlation of fragmented data points from decentralized networks and a greater reliance on AI-driven analysis of publicly available information (PAI) to build profiles, moving beyond simple API-based lookups. The “low-hanging fruit” will become scarcer, professionalizing the OSINT field further.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Levraicontractuel Osint – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
