X-Perience the best of SOCMINT on Twitter.
This platform is dynamic, real-time and perfect for Open Source Intelligence (OSINT)... Wait, it’s not Twitter anymore – it’s X.
Whatever you call it, Twitter (X) is one of the most widely used social media platforms, with a wealth of publicly accessible data: user profiles, tweets, hashtags and geolocation information. This makes Twitter (X) OSINT a vital tool. Its open ecosystem allows users to share personal insights in a way that’s universally visible – and along the way, most share professional details, contact information and more.
For verifying identities, tracking trends, or uncovering hidden connections, Twitter (X)'s vast network provides endless opportunities for OSINT. However, this platform has its drawbacks. It can be easy to get lost, packed to the brim with bots (despite Elon’s claims) and requires a keen understanding of its features, tools, and ethical boundaries to achieve OSINT success.
Let’s outline some proven OSINT techniques for extracting user details, phone numbers, and email addresses, all while adhering to legal and ethical boundaries from Twitter. If you don’t forget to call it ‘X’, that is.
What is Social Media Intelligence (SOCMINT)?
OSINT refers to the collection and analysis of publicly available information. This includes data from social media platforms (like Twitter (X)), online databases, search engines, public records, and more.
The key principle of OSINT is that it relies solely on legally accessible information. For a deeper dive into the fundamentals of OSINT, check out our article, What is OSINT?
SOCial Media INTelligence, or SOCMINT, is one of the most popular OSINT branches with investigators. It’s largely free, relatively simple (if you don’t plan to use advanced techniques) and capable of unearthing insights that can revolutionize a case. SOCMINT is the practice of OSINT on social media: to investigate individuals, understand public sentiment, track digital footprints, and more.
OSINT in 180 Characters: How Does Twitter (X) Work?
Most people are aware how Twitter (X) works, even if they don’t use it themselves. Twitter, since before it became X, operates as a microblogging platform where users share short messages, formerly "tweets," with their followers. Unlike private messaging apps, Twitter is all about public communication; perfect for OSINT analysts.
Key features include:
- Public Profiles: Most accounts are public, with posts, followers, and activity visible to anyone.
- Protected Accounts: Some users opt for protected accounts, restricting access to approved followers only.
- Direct Messages (DMs): While DMs are private, public interactions like mentions, replies (often used as substitute for DMs) and public posts requesting to DM can illuminate user connections anyway.
- Hashtags and Trends: Twitter (X) transformed the hashtag. No longer just ‘the key nobody presses’, hashtags (#) allow users to participate in broader conversations – often exposing their interests, affiliations and beliefs as they go.
Twitter OSINT vs X OSINT: How Does X Differ From Twitter?
There’s an elephant in the room when we’re discussing Twitter.
Elon Musk’s acquisition of Twitter, for better or worse, resulted in Twitter becoming ‘X’. Many users have failed to (or refuse to) adjust to the name-change, but the platform-formerly-known-as-Twitter has undergone significant changes in its features, functionality, and overall direction under new leadership.
One of the most notable shifts is X’s potential evolution into an "everything app," aiming to integrate services like payments, shopping, and content creation beyond traditional social media. This has for the most part failed to materialize, but features like long-form articles, ad revenue sharing for creators, and subscription-based verification (via ‘X Premium’) have altered user engagement dynamics quite a bit.
X also relaxed certain content moderation policies, increasing misinformation and hate speech. Additionally, technical changes, such as algorithm adjustments favoring paid users and the removal of legacy verification checkmarks for political figures and celebrities have led to issues like impersonation and ‘fake news’. While X retains core elements of Twitter, its broader ambitions and operational shifts reflect a departure from its original identity as a microblogging platform.
For OSINT analysts, this is the positive out of Pandora’s Box. Twitter (X)’s openness sets it apart from other social media platforms. While apps like Telegram combine private messaging with public channels, Twitter is almost entirely public by design. This makes it a unique resource for OSINT, as users frequently share personal information, contact details, and insights into their lives and activities. As moderation slips and ‘anything goes’ Twitter (X) OSINT subjects might speak more freely and reveal more intel than they would have in the past.
To sum up the changes from Twitter to X:
- X Premium (formerly Twitter Blue): Subscription-based verification, edit tweets, and priority in conversations.
- Ad Revenue Sharing: Creators earn a share of ad revenue from replies to their posts.
- Long-Form Articles: Users can publish extended content, with no character limit.
- Payment Integration: Plans to introduce peer-to-peer payments and banking features. (But not yet.)
- Community Notes Expansion: Crowdsourced – and often ineffective – fact-checking to address misinformation.
- Algorithm Boosts for Paying Users: Tweets from X Premium subscribers are prioritized in feeds, regardless of content or veracity.
- Job Listings: Companies can post job openings directly on X.
- Video and Audio Updates: Enhanced support for long-form video and live audio ‘Spaces’, similar to Zoom or Microsoft Teams.
- Removal of Legacy Verification: Traditional blue checkmarks have been replaced with paid verification, with no credentials required.
How Does This Change OSINT on Twitter (X)?
You may be asking what the transformation of Twitter into X means for OSINT. The platform’s (unlikely) push toward becoming an "everything app" introduces both new challenges and new opportunities for intelligence gathering.
These are laid out on the table below:
Meanwhile, for law enforcement and journalists, Twitter’s transition to X makes it a hotspot for malicious activities, including cybercrime, hate crime, and the spread of disinformation. Therefore Twitter (X) OSINT has become invaluable for:
- Journalism: Verifying sources, exposing bad actors, uncovering leads, counteracting misinformation and fighting ‘fake news’.
- Law Enforcement: Tracking criminal activity, exposing bad actors, and gathering evidence – particularly in extremism or hate speech investigations.
- Corporate Investigations: Monitoring brand mentions and identifying threats.
OSINT on Twitter: Three Key Approaches for X
When conducting OSINT on Twitter (X), most investigators have three aims:
- Finding Twitter Profiles and Usernames
- Extracting Phone Numbers from Twitter Accounts
- Uncovering Email Addresses Linked to Twitter Accounts
Below, we’ll explore effective techniques for each approach.
Twitter Profiles: OSINT for X User Details
Every Twitter user has a unique username (e.g., ‘@OSINTIndustries’), which serves as a starting point for investigation, and can reveal further intel. Here’s how to get hold of usernames and associated basic personal information:
Twitter (X) Built-In Search
Use Twitter’s search bar to look up usernames, hashtags, or keywords. Public profiles often reveal names, bios, locations, and follower counts on-page. Isn’t OSINT easy sometimes?
Look In The URL Bar
If all you need is a username, look in the URL bar at the top of your browser. The username you need will be listed at the end of a profile’s URL. It’ll also be listed underneath every user’s display name on their profile.
Analyzing Posts and Activity
A user’s posts, reposts, and likes can provide extensive insights into their interests, professional life, and even location. Geolocation data (GeoINT) data in tweets can be particularly valuable, as can political posts that reflect affiliations and beliefs.
Cross-Referencing Usernames
Looking for other socials? Unlike Elon, most social media users don’t like to change names. Many users reuse the same username across multiple platforms. You can use these Google Dorks to find linked accounts:
site:twitter.com "username"
site:linkedin.com "username"
site:github.com "username"
OSINT Tools
Tools like Maltego and OSINT Industries can do the hard work for you, leaving you more time for the real work of OSINT analysis. These tools can even automate the process of gathering user details and mapping connections – OSINT Industries Palette is particularly helpful for this.
X Phone Numbers: OSINT for Twitter Phone Lookup
While Twitter – or X – doesn’t display phone numbers publicly, very generous users have been known to share them in tweets, bios, or linked profiles. Even if they don’t, here’s how to find them with OSINT:
Public Posts
Search for keywords like “contact me,” “call me,” or “phone number” in posts. Advanced search operators like the following can help narrow results:
"phone number" near:"city"
"contact us" site:twitter.com
This one is to be approached with caution if automated or scraped.
Analyzing Linked Profiles
Users often link to other social media accounts or websites in their bios. On other linked socials, they may be more forthcoming with phone numbers or additional contact details. Socials like LinkedIn, Facebook Marketplace or any other business or eCommerce platforms are a great lead.
OSINT Phone Lookup Tools
If you have a phone number, use reverse lookup tools to see if it’s linked to a Twitter (X) account. If not, you can still use a tool like OSINT Industries to conduct a lookup with another selector. Searching with usernames, emails or phone numbers will comb through 1000+ modules to find those linked socials with listed numbers, breached data – or even just the digits you need in your results.
Twitter Email Addresses: OSINT for X Email Lookup
Again, Twitter (X) doesn’t display email addresses publicly, but users often share them in posts, bios, or linked profiles. Many users may sign up and log in to Twitter (X) with an email address, but you’ll need the following techniques to uncover them:
Public Posts and Replies
Search for keywords like “email,” “contact me,” or “DM for details” in tweets. To repeat, this one is to be approached with caution if automated or scraped. Look if your subject has replied to any job postings or business-related posts, as these often encourage the posting of email addresses.
Linked Professional Profiles
Many professionals will put emails ‘in bio’. If not, check LinkedIn, GitHub, or personal websites linked in bios for email addresses; a user may not be as privacy-minded on a more professional-focussed platform.
Google Dorking
When in doubt, dork. You can use advanced search operators like these to dork email addresses associated with Twitter (X) accounts on the search engine of your choice:
"email" site:twitter.com "username"
"contact me" site:twitter.com
OSINT Email Lookup Tools
OSINT email lookup and reverse email lookup tools, like Maltego or OSINT Industries identify email addresses linked to specific usernames, phone numbers and social accounts. With access to over 370+ email modules, you’re likely to find that Twitter email with a tool like ours.
Conclusion: Key Takeaways for OSINT on Twitter (X)
Twitter’s transition into X provides new opportunities for OSINT. However, it also introduces challenges that require analysts to be more adaptable, critical, and resourceful in their approach than ever before.
Done right, Twitter (X) OSINT can tap into a vast network of users and real-time data and conduct #OSINT4Good. Tracking down a username, uncovering a phone number, or linking an email address in Twitter (X)’s open ecosystem should be the first step to impactful OSINT.
This platform is changing. As you go ahead conducting OSINT on X, the following skills will be more critical than ever:
- Adaptability: OSINT analysts must be able to adjust to X’s evolving features and policies, which can change on a whim.
- Critical Analysis: Don’t fall for fake news. Increased misinformation demands more rigorous verification processes, or else your investigation might fall apart.
- Broader Scope: X’s expanded functionality offers more characters, and richer data. This requires more sophisticated OSINT analysis techniques, and more hard work.
- Ethics: OSINT analysts must ensure they respect user privacy, avoid amplifying harmful content, and adhere to legal guidelines when collecting and sharing information.
To see Twitter (X) OSINT in action, check out our Case Study.
‘Whenever the government’s Mafia ties were questioned, suspicious accounts spread hashtags intended to discredit journalists…’
Read: Nestor, A Journalist Uncovering Colombian Crisis and Corruption
