What's New in 2.0

• Per-user data isolation · team members only see their own data, admins see everything
• Bastion Comms · encrypted team messaging with channels, DMs, file sharing, auto-expiring messages
• Global loading bar · visual feedback on every operation
• Network Map filters · filter by node type and collection group
• Bot code detection · mtfxqbot, mtfxq2bot, and 11+ Chinese file-sharing bot patterns
• Faster WHOIS · lower timeouts, batch commits, better error handling
• Username Harvester fixes · sender extraction and live member list pulls working
• Media Evidence · download and hash channel media with your TG credentials

Collection Modes

• API Mode · pulls full history with sender IDs, usernames, replies, forwards, media metadata. Needs a burner account.
• Web Scrape · no login needed, no ban risk. Public channels only, limited history, no sender data.
• Import · bring in Discord (DiscordChatExporter JSON), Reddit (JSON), or generic CSV/JSON. Everything lands in the same database for cross-platform work.

Protecting Accounts

• Set a 0.5 to 2 second delay between messages
• Let burner accounts age a few days before first use
• Join groups manually before collecting
• One group at a time per account
• Rotate 2 to 3 burner accounts for heavy work

Message Analysis

Search and filter collected messages by text, sender name/username/ID, collection group, or media type. Tag messages as evidence against suspects. Cross-reference any sender to see every group they show up in.

Suspect Management

Build suspect profiles with aliases and multiple identifiers (Telegram ID, username, phone, etc.). Tag evidence, view timelines across groups, and put together evidence packages for law enforcement.

Username Scanner

Take any username and check it across 25+ platforms (Twitter/X, Instagram, Reddit, TikTok, GitHub, Telegram, Discord, and more). Link results to suspects so they go into evidence packages.

Web Recon

Scrape any public URL for emails, phone numbers, social handles, Telegram/Discord invites, crypto wallets, and other indicators. Set crawl depth to follow internal links. Can route through Tor.

Network Map

Force-directed graph showing how channels, suspects, bridge contacts, and shadow groups connect to each other. Filter by node type or collection group. Drag nodes around to rearrange the layout.

Dark Web / .onion Tracking

Picks up .onion addresses in every collected message. Tracks who shared each link, in which groups, and how often. Shows who distributes the most dark web links. Can scrape .onion sites directly through Tor.

Invite Link Hunter

Finds paths into private groups from your collected data:

• Invite Links · every t.me/+ and joinchat link found in your messages
• Shadow Groups · private groups that show up in forwarded message headers
• Bridge Contacts · people active in both public and private groups, scored by risk
• Paste Site Scanner · searches paste sites for leaked Telegram invites

Code Word Engine

Define coded terms using wildcards or regex, set categories and severity levels, then scan everything. Preloaded packs for Chinese abuse terminology (aimao/爱猫). Results show full context, top flagged senders, and severity color-coding.

Bot Code Tracker

Finds and tracks file distribution bot codes (ShowFilesBot, mtfxqbot, mtfxq2bot, FilePan, and 10+ other Chinese file-sharing bots). Scan messages, import text dumps from bot chats, track who shared what, mark codes as reported, and export abuse reports for Telegram Trust & Safety.

Entity Extractor & Public Records

Pulls names, organizations, and locations out of messages. One-click search links into 13+ databases: OpenCorporates, ICIJ Offshore Leaks, OCCRP Aleph, FEC, OpenSecrets, court records, and others.

Username Harvester

Grabs all unique senders from collected messages, pulls live member lists from Telegram groups via API, and cross-references against forum usernames. Gives you social media search links for each sender.

Financial Investigation

• Payment Trails · extract crypto addresses (BTC, ETH, TRON, LTC, XMR, USDT) from messages
• Blockchain Explorer · check balances and transaction counts for extracted addresses
• WHOIS Lookup · bulk domain registration lookups on all extracted links
• Sanctions Check · screen addresses and entities against sanctions lists
• Political Finance · search FEC contributions and OpenSecrets data

Chinese Networks Module

Corporate registry search across HK, SG, TW, CN, and offshore jurisdictions. Social media lookups on Weibo, Douyin, Xiaohongshu, Bilibili, and more. Batch username scanning and TRON blockchain analysis for Chinese payment flows.

Media Evidence

Download media from Telegram channels and bots. Files get SHA-256 hashed and perceptually fingerprinted (pHash) so you can catch duplicates across sources.

Reports & Export

Generate investigation reports, suspect evidence packages, and full data exports. Reports include integrity hashes for chain-of-evidence verification. Export to JSON and CSV.

Team Features

• Multi-user accounts · invite-based registration with admin/analyst roles
• Bastion Comms · encrypted team chat with channels, DMs, file sharing, pins, reactions, burn-after-reading
• Activity Log · full audit trail of all team actions
• Database Archives · snapshot, restore, download, and upload investigation databases

Security