How to find the owner and administrator of a Telegram channel

Next to Hate-Speech and Scam investigations, it came to attention, that malware authors can be increasingly seen using Telegram-based tactics to enhance their malware capabilities. Thise leads to the necessity of finding ways how to track back the owner and admin of a Telegram channel.

It is important to understand that there is no universal way to find the administrator and owner of the channel. However, you can separately identify working methods and sources that help answer the question.

What question? Before you start your search, make sure your goal is clear. Do you want to know who owned the channel? Who is the administrator there? Who owns it now? Or all of them together?

You won’t see any phishing or social engineering techniques in this article. We will work with history and minimize interaction with users.

Let’s decide what we are going to work with, what we know about the channel, and what we are going to do about it. This is what is usually more common on the channel:

Publication


What can be in it? Everything. Photos and audio, links and files. Gather from the sweats: text, links, audio, video, images and find in t.me/HowToFindBot where to search by this data. Is there a photo in the post? Pick a photo search in the bot and go through each source in the list. But, here’s what’s in the post that will lead us to the target:

I. Referral link

This is a link with a referral ID. Channels post a link to the bot where the Telegram ID of the bot’s user is encoded or visible. Example: https://t.me/PimEyesBot?start=445588014

where 445588014 is the Telegram account ID.

Don’t hurry to throw the link if there are letters after the start, this is an internal user ID. Find out the way to find the user bot’s internal ID. Ask support of this bot who created the link or search inside the bot if its functionality allows you to do it.

II. Private link

Until 2017, Telegram generated private links to groups and channels with the encoded account ID of the creator of that link, i.e. the admin or channel creator.

What does a private link mean? It’s the one with the phrase joinchat in it.

Example: https://t.me/joinchat/AAAAAFcF8lv6w7Y4RfSW5Q

What kind of links contains IDs of a Telegram account?

  • Long links. These links contain 18+ characters after the joinchat phrase. Example: https://t.me/joinchat/FNPR30Fs51OX1853MfCKVg

What kind of links have NO account ID?

  • Public ones. The address in this link is set by the administrator himself, whatever he wants and writes in it. Example: t.me/durov
  • In links with AAAAA. What is AAAAAA? These are the encoded zeros instead of the account ID. Consequently, such links are useless to decrypt. Moreover, they lead only to private channels. According to the web archive, these links appeared in early January 2017.
  • Example: https://t.me/joinchat/AAAAAFcF8lv6w7Y4RfSW5Q
  • In short. Telegram introduced these for both channels and groups. They appeared in 2019 and are still being created today. Contain up to 18 characters after joinchat. Example: https://t.me/joinchat/t5OICPRwudQ2MmFh

How do I decrypt and find out the account ID of the person who created this link?

  1. Make sure the link contains your account ID. We have already listed the types of links above.
  2. Copy everything after the phrase joinchat. Example: from http://t.me/joinchat/D-3jrhMOTiIE-WwV8wnomA there will be D-3jrhMOTiIE-WwV8wnomA. This is the hash amount.
  3. Go to 8gwifi.org. On the site, type this hash sum into the first input, and click Sumbit.
  • Copy the resulting Hex and open cryptii.com.
  • Type the Hex in the field like in the picture. Set it to 32 bits. Check your decryption settings like this:

You will get a number, this is the account ID of the creator of the private link. Example: 267248558.

To find out the account information and mentions by ID, you can use the resources for searching by Telegram account ID in the source directory – t.me/HowToFindBot, where there is a resource t.me/usinfobot. Let’s type @usinfobot 267248558 in the message input field and find out the name and link of the Telegram account.

If the link does not work, the account ID remains, but you will not know where it led so quickly. Look for references to the link in the Telegram search engines like Telegago and Google, too.

III. Signature of the post

Say banal thing, but in fact, it ignores, does not notice. This signature is placed near the time of publication, consists of the name and surname of the account. So why can it be overlooked? Even one signature out of all hundreds of unsigned publications is possible. Look through all the channel’s posts carefully. You might be lucky enough to come across a name.

Got a signature? Look for it on Telegram and in the channel group. 

IV. Repost

A repost is when a message from one channel or user is sent to another channel.

A repost from a channel is often made by subscribers, which means that the administrator and/or owner is subscribed to the channel from which it was reposted. Look to see if there is a chat room and who mentions our channel or its content. It could be fans, but that’s what the admin and/or owner are most interested in. Write down anyone who liked the mention and content of the channel in the chat. We’ll look for matches.

Group

The group is connected to the channel and may or may not be, it’s not that important. It is important to first make sure that the group is connected to the channel. This can be seen on the channel itself, there is a link to the chat or open comments on posts.

How to use a group to find the owner of a channel.

  • If the administrator is in the group, so is the channel. It’s simple.
  • Writing in chat on behalf of the group? These are anonymous admins. But you can find them. First, scroll to the beginning of the chat. See who first joined the group. Who hands out commands to the bots to the moderators. So who to look for, and what are the criteria. Admin who hid under the anonymous now has a message in the group without a signature admin, it is not in the list of members, and there is not even a message that he left the group, because he has not left it, but was just hidden. However, these are circumstantial signs, but important.
  • Look up who the group members refer to as an admin. Open the search in the group and enter the following phrases: admin, /admin, administrator, etc.
  • Delete all chat messages, this allows you to do in Bgram, then only the system messages will remain, you can see who has secured a message, who started a voice chat, etc.
  • Ask the members of the chat and in the chat itself.
  • Search for mentions of the group in Telegram search engines.
  • Collect all the links to the groups that are in the chat. Look for joinchat or t.me groups. And there, check who mentions the channel or group. This is where recursion comes out.
  • Read the whole group. Lots of messages? Read if nothing worked.

Channel image

Mentioning an image leads to the channel archive or publications outside of Telegram. A reverse image search such as Yandex Images is the first source to check for mentions, after that the top is Google Images and everything else at t.me/HowToFindBot.

Channel name and address

The first thing to do with this is to find their mentions online. It is best to use search engines capable of searching Telegram, the full list is at t.me/HowToFindBot. This way you can come across publications with ad buying, admin inviting to subscribe to the channel, admin reposts, and similar mentions.

The second is to take the nickname from the channel address.

And use resources to search by nickname in t.me/HowToFindBot. In which there is a tool Maigret, t.me/maigret_osint_bot, Sherlock, and others.

And if the channel is private? Look at point II. Private link.

Deleted posts

How to know that a post was deleted from the channel:

  1. Copy the link to the last post. Example: t.me/durov/171
  2. Count all the posts of the channel, for example, by highlighting them. Example: the channel t.me/durov has a total of 138 posts
  3. The serial number of the last post is 171, and the total number of available posts is 138.
  4. Calculate the difference: 171 – 138 = 33.
  5. We get the number 33. This is the number of posts that were removed from the channel.

How to look for them:

The analytics sites that are in the HowToFind directory retain the channel’s posts, even after they are deleted. You can also find the channel profile on these resources by name and link. According to statistics, advertising posts are most often deleted. They indicate the person who paid for the ads. It’s the advertiser, you can write to him, find out how he placed his post, and with whom he negotiated for this and who he paid.

Don’t forget to look at the point of publication, the deleted post belongs to him too.

History of channel name change

The channel itself has information about when and what the name of this channel was changed to, only the regular Telegram app will not show this. You need Telegram X on Android, download and open it, and go to the channel in it. 

When you create any channel, you have to set a name. This will be the first name that will always remain in the first message of the channel. You can scroll to the first post to get there, but it is easier to link to that post. Example: t.me/durov/1

Do not forget about the fact that the name of the channel may change, and all these changes are also recorded on the channel among the publications. If the channel has a lot of posts, select all the posts and delete them, but you can only delete them in alternative clients of Telegram, such as Bgram. Then, the system messages will remain in front of you. Including name changes. 

It is only allowed to delete channel posts if you have administrator or channel owner rights, this is a restriction imposed by the Telegram client on Android. How can other clients help? Other clients allow non-administrators to delete posts. For example, in Bgram and Telegraph, you can go to the first message by pressing one button. Highlight the first, and at the end of the channel the last post, and then you can highlight all the publications of the channel and delete them all at once. Fear not, the posts are not deleted but only hidden on your device.

The system messages about changing the channel name remain. Don’t forget that the first message with the channel name is only visible in Telegram X.

How to use these names? See the methods for channel names described above.

Channel Description

It is of little use if there are no links. Even so, contacts are leading to the channel administrator. Take a look at the channel description at tgstat.ru, for example, which is in the t.me/HowToFindBot directory. Tgstat saves the description of the channel.

Unfortunately, Tgstat only stores the first 30 characters of the description, but updates rarely.

Summary

Using the methods and resources in this article, it is possible to reach the goal and find out who the administrator and owner of a Telegram channel is. However, there is no guarantee that these methods will work for every Telegram channel and group. If you cannot do it yourself, write to the group t.me/HowToFind_chat where they will help you with the search.

If the search is fruitless, follow the channel, use t.me/AximoBot. New publications of the channel this bot will save and send in private messages. You will not lose a suddenly deleted new post. 

SHARE

These articles are for informational purposes only, their content may be based on employees’ independent research, and do not represent the position or opinion of Artefaktum. Furthermore, Artefaktum disclaims all warranties in the articles’ content, does not recommend/endorse any third-party products referenced therein, and any reliance and use of the articles is at the reader’s sole discretion and risk.