A tweet is one data point. A Twitter account is a behavioral time series - and most OSINT tooling treats it like a static profile card. Here is the free, public-web layer I run on accounts that matter to a case, and the features that make it worth the polling code.
1. The posting cadence signature. Bursty at odd hours, flat on weekends, spikes on match days - accounts have fingerprints. Poll the public profile HTML (the web preview exposes recent posts to logged-out browsers for many accounts) on a fixed schedule, store timestamps, compute the cadence series. A sudden cadence break - quiet for 10 days, then 40 posts in 2 hours - is an event: account takeover, a coordinated campaign starting, a person quitting social media in a huff. All of these are intelligence-relevant and none require reading a single tweet.
2. The follower growth curve with churn asymmetry. Followers is public. A day of -800 followers after a controversy is a measurable reputation event; a +5k overnight with a flat engagement curve is purchased audience (same test as Telegram subscriber spikes - bought growth arrives as a step, organic as a ramp).
3. Engagement rate as the honesty check. (Replies + reposts + likes) / followers, per post, trended over months. Real accounts drift; engagement-farm accounts are suspiciously steady. An account whose engagement rate jumps the week a narrative starts is a node someone is paying to push.
4. The URL graph. Every link an account posts is an edge to the information ecosystem: which media cluster, which paste site, which shop. The domain histogram of an account's outbound links is a cheap ideology/interest profile, and it's stable enough to be a fingerprint. One account moving its outbound diet from news to crypto-giveaway domains is a monetization tell.
5. Bio mutation history. Bios change with campaigns, jobs, and rebrands. Poll and diff the bio text; the diff history is a mini timeline of the account's life, timestamped by your own polls - free, because nobody archives bios and you become the archive.
Scope note: all of this is read-only collection of public data at polite cadence (hourly/daily, not firehose). The product is the time series - single snapshots are replaceable by anyone, the archive you own is not.
The polling cadences, feature formulas, and alert thresholds ship in the Telegram & Web OSINT Bundle ($5) - the methodology is cross-platform, the Telegram module is one of six. Free sample brief.
Runs free on GitHub Actions - no server, no paid APIs.
Top comments (0)