Telegram Network Visualization — Tracing Forwards and Mentions

Visualize the flow of information through Telegram public channels using a free graphing tool, without Telegram sign-up

osint discovery
DataSeries
5 min readJan 30, 2021

--

Graph network showing Telegram channels that are of interest to cryptocurrencies pump-and-dump groups
Telegram channels that are of interest to cryptocurrencies pump-and-dump groups. Nodes are public Telegram channels, Edges are Forwards or Mentions between channels. | Source: Screenshot by the author, generated using Gephi

Telegram reported a surge in active users after WhatsApp’s new terms of services raised privacy concerns. This article will explore avenues of getting public Telegram data without the need for account sign-ups, and the use of graph visualization to discover information flow between Telegram channels.

A tweet from Pavel Durov, founder of the Telegram Messenger, showing a surge in new account sign-ups. | Source: Screenshot of Telegram Messenger’s Twitter profile

Public Telegram channels are viewable without signing up for a Telegram account. There are many online Telegram archives that perform searches for Telegram channels. Let’s use this Telegram Explorer to search for cats, and pick the channel Kitty Cutie Pie, with channel ID pet_me_feed_me.

Flow chart showing searching and previewing public Telegram channels
Source: Screenshots of Telegram Explorer, Telegram Web

If the channel is a public one, there may be a Preview Channel option. This allows us to view the channel on a web browser without signing up for a Telegram account. Data such as profile picture, channel description, channel member count, message content, message posting time, and message view count are openly-available.

Channels are linked up through Forwards and Mentions. The screengrab on the bottom left shows a forwarded message from the Eduji Furchan channel, while the screengrab on the bottom right shows a mention of the World_of_Puppy channel.

Screenshot examples of a Forward and a Mention
Source: Screenshots of Telegram Web

Tracing out forwarded messages and mentions could help detect communities across Telegram channels and identify the source origin of content.

Prepping Data for Gephi

Gephi is a free online graph visualization tool that comes pre-packaged with layout algorithms and network metric calculations.

To ingest CSV files, Gephi requires data to contain the following column names, which are case sensitive.

  • Node.csv — Id, Label
  • Edge.csv — Source, Target

Other attributes may be added. For example, the column ‘Size’ (which represents that Telegram channel member count) is added to the node table. Load the CSV files under the Data Laboratory tab.

Screenshot showing the loading of CSV files into Gephi Data Laboratory
Source: Screenshot by the author, generated using Gephi

Perform the following transformations in the Overview Tab.

  • Layout: Choose an algorithm (e.g. OpenOrd) to arrange nodes in clusters.
  • Statistics: Run the Modularity function for cluster detection, and color the nodes based on the modularity class.
  • Node Labels: Turn on node labels, and play around with different fonts to display Chinese, Russian, Arabic characters, where necessary.
  • Node Size and Label Size: Scale node size and label size based on a calculated network metric (e.g. degree).
  • Readjustment: Run the Nooverlap and Lael Adjust algorithm so that nodes and labels do not overlap.
Screenshot showing transformation steps in the Overview tab
Source: Screenshot by the author, generated using Gephi

Head over to the Preview tab for the final aesthetic touch.

  • Opacity: Decreasing the opacity of nodes and edges helps improve the readability of labels.
  • Scaling: Label size and Edge thickness can be scaled.
  • Export: For a higher resolution screenshot, increase the pixels before doing a PNG export. You may have to increase Gephi memory here, to support exports of a higher pixel count.
Screenshots showing edits in the Preview tab
Source: Screenshot by the author, generated using Gephi

Let us replicate these steps to analyze Telegram channels for a recent case.

Discovering Popular QAnon Sources

The QAnon community is active on Telegram, spreading conspiracy theories and distorting narrative pieces that may appear to be aligned with their ideologies.

Let’s use the network for Forwards and Mentions to find out where they are getting their information sources and which Telegram channels are of interest to them.

Our starting seeds are these eight channels that are obviously QAnon-related.

Screenshots of the eight QAnon Telegram channels that were used as the starting seeds
Source: Screenshot of search results from Telegram Channels

By performing an iterative crawl for channels that were forwarded and mentioned by these starting seeds, we can build up the graph network below.

Screenshot of the Graph network of Telegram channels that were referenced by QAnon-related channels
Source: Screenshot by the author, generated using Gephi

The network shows a main cluster, probably for English speaking users, and two smaller clusters that cater to Russian speaking users.

Besides QAnon-related channels, the main cluster also contains sub-clusters made up of US politicians, news networks, meme creators, and far-right groups. Nodes that are connecting these sub-clusters include Telegram channels that are named after Donald Trump, Lin Wood (conspiracy theorist), and Vincent James (controversial political commenter). This suggests that these personalities are generating content that is of interest to QAnon supporters.

The nodes’ size is scaled using Page Rank scores. Big nodes would represent Telegram channels that are commonly referenced by influential QAnon channels. Let’s look at two of the biggest nodes — GALLIA DAILY and Disclose.tv

GALLIA DAILY was touted as a ‘cream of the crop content creator channels’ by a Telegram group who strongly advocated that the recent election was a fraud.

Screenshot of a Telegram post which stated that GalliaDaily is a content creator channel for conspiracy theories
Source: Screenshot of Telegram Web

Narratives from Disclose.tv was previously debunked to be intentionally misleading and was exposed as a fake news site.

Disclose.tv is a fake news site included in PolitiFact’s Fake News Almanac, a collaborative effort with the Poynter Institute and Facebook to define websites that have deliberately published false or fake information.

— Snopes, fact-checking site

The graph visualization shows a heavily connected cluster, which also means that a user would more likely to be exposed to channels of similar narratives, reinforcing their existing views while being insulated from external rebuttals. I did some open-sourced research to understand these echo chambers in the article here.

Conclusion

Graph representations of Telegram forwards and mentions could help us identify like-minded communities and interpret the flow of narratives. Data collection, transformation, and visualization are made easier through public Telegram channels and Gephi Open Graph Viz Platform.

References

[1] A. Kharpal, Signal and Telegram downloads surge after WhatsApp says it will share data with Facebook (2021), CNBC

[2] EJ. Dickson, The QAnon Community Is in Crisis — But On Telegram, It’s Also Growing (2021), RollingStone

[3] M. Dapcevich, Did Pence Unfollow Trump on Twitter Following Jan. 6 DC Riots? (2021), Snopes

--

--