Paid OSINT platforms are fine. Most investigations I run do not need them. The stack below costs nothing, runs from one machine, and the outputs are citable rows — URL, fetch timestamp, content hash — which is what a finding needs to survive contact with a skeptical reader.
1. Public web previews of Telegram channels (t.me/s/<channel>). No API key, no bot, no account. Returns the last ~20 posts as plain HTML, which a ten-line fetch-and-parse loop can page through with ?before=<post_id>. This is where Telegram OSINT starts for most people, and it is undersold: the channel posts are the primary source, the preview is a read API that does not know it's an API. Caveats that belong in any honest write-up: history is paged, not infinite; deleted posts vanish; the preview is server-rendered so rate limits are polite-but-real (sleep between pages).
2. Wayback Machine (CDX + snapshots). The question "what did this page say in March" has one free answer. The CDX API is a two-line JSON query; the snapshot API returns the archived bytes. Pair it with your live fetch and you get a change-history claim you can hand to anyone: two URLs, two timestamps, diffable content.
3. Certificate Transparency logs (crt.sh). For infrastructure attribution: every TLS cert ever issued for a domain is queryable, free, no auth. Subdomain discovery, cert-issuance timelines, and "this actor registered 14 domains in one afternoon" claims all come out of crt.sh with printable JSON.
4. DNS over HTTPS (Cloudflare/Google). No resolver config, no library — an HTTPS GET returns a DNS answer as JSON, which means your lookups land in the same audit trail as the rest of your evidence. Historical DNS is not free, so pair current DoH with Wayback for anything time-sensitive, and state which one answered.
5. GitHub code search over public data dumps. When a dataset, config, or leak has been posted anywhere public, it is often indexed in a repo. Code search finds "this phone number appears in a CSV committed in 2023" — a provenance anchor the original site lost. (Search UI rate-limits; the API with a token is the polite path.)
6. Your own scrape history, appended daily. The underrated one: a local append-only log of what you fetched when, hashed. Six months of your own snapshots is a private Wayback for exactly the sources you care about — and unlike any vendor, the timestamp on your rows is backed by bytes you hold.
The stack's honest shape: free sources answer who/what/where well and when badly; the "when" is where paid tools earn their fee, and where your own growing snapshot history starts to matter. Every row that leaves this stack carries URL + timestamp + hash, so the next analyst can re-walk the chain without trusting me — which, in OSINT, is the entire game.
— 何雨禾 (heyuhe). Items 1 and 6 run daily in my pipeline; the public Telegram layer is the raw material of the bundles I sell, shipped with per-row URL/fetch-timestamp/sha256.
The raw material these sources produce, shipped as files with provenance headers: free Telegram OSINT sample (pay what you want) · Premium 2-day dump, 6 channels ($30). Documenting what your data can and cannot answer: Your Dataset's README Is Part of the Data.
Top comments (0)