X’s (formerly Twitter) large user base and immense data collection make it a goldmine for Open Source Intelligence (OSINT) and Social Media Intelligence (SOCMINT) investigations.
Social Media Intelligence (SOCMINT), a branch of OSINT, focuses specifically on collecting information from social media platforms. Every social media platform, however, is unique, necessitating tailored guidance for effective OSINT investigations.
(Check out our SOCMINT guides for Facebook, TikTok, Discord and Reddit here.)
In this X (Twitter) OSINT/SOCMINT guide, we will cover how to leverage tools and techniques to collect and analyze information found on X for intelligence purposes.
Twitter was a microblogging social media platform launched in 2006 by Jack Dorsey, Noah Glass, Biz Stone, and Evan Williams.
In 2022, it was acquired by Elon Musk, who rebranded the platform and renamed it X (www.x.com) after merging it with his company, X Holdings.
Initially, the short messages users were able to post on Twitter were limited to 140 characters. However, in November 2017, the number of permitted characters per message was increased to 280.
In February 2023, after Twitter’s ownership change and rebrand, X increased the character limit to 4000 for X Blue (paid) subscribers, while the character limit remained at 280 for free accounts.
In April 2023, the character limit for premium accounts increased again to 10,000. The last increase took place in June 2023, allowing 25,000 characters for X Premium subscribers.
The platform’s core features include hashtags for topic categorization, retweets for sharing content, and threads for connecting multiple posts to create a mini-discussion forum. These mechanisms have facilitated the rapid spread of information during major political events like the Arab Spring and various political elections, like those in the United States.
X has a large, global user base, with the majority of users (nearly a third) located in the United States. However, these numbers have fluctuated due to significant events at Twitter and X.
Between 2019 to 2022, Twitter’s user base grew steadily, going from 312.7 million in 2019 to 401 million monthly active users in 2022. However, after Musk acquired Twitter and rebranded the platform as X, the monthly active users dropped to 388 million in 2024.
Source: https://www.businessofapps.com/data/twitter-statistics/
X is an invaluable tool for Open Source Intelligence (OSINT) gatherers because of its real-time nature, diverse user base, and wealth of publicly available information.
It could be exploited to gather intelligence on individuals, organizations, events, trends, and even geopolitical developments.
Here are the main areas that make the X platform valuable for OSINT gatherers:
X provides real-time information sharing about global events, breaking news, and emerging trends. This makes it a valuable source for gathering intelligence on natural disasters, political protests, or cyberattacks.
For example, during the 2020 Beirut explosion, X was one of the first platforms to broadcast footage and videos of the initial moments of the explosion.
Similarly, during civil unrest in many countries, X commonly serves as the primary channel for firsthand accounts before traditional media coverage.
Many X users tag their tweets with their current geolocation data. This makes it valuable to track individuals' movements, identify locations, or map activities. Intelligence analysts can use this data to verify event claims or identify movement patterns within specific geographical areas.
X contains a large number of users. Public user profiles contain a plethora of helpful information, including personal photos, links to other social media platforms, contact information (such as email addresses and sometimes phone numbers), join dates, and their followers network. Analyzing this information can help build a detailed online profile of an individual or organization. The connections between accounts also reveal affiliation networks that may not be immediately evident.
OSINT gatherers can use trending hashtags to track public sentiment, propaganda campaigns, or coordinated disinformation efforts.
For example, we can retrieve an incredible amount of content related to the Russian-Ukrainian war by researching on hashtags such as #russiawar, #russiaukrainewar, #russiaukraineconflict, and #standwithukraine.
X is a rich source of multimedia content, like images and videos. These files can be analyzed for metadata, timestamps, and other geolocation clues, making this content a great source of information for OSINT gatherers.
For example, by analyzing images uploaded to X or linked content, we can identify when an event occurred, recognize the geographical location of the event, or the people appearing in the image or video.
Many political and public figures use X as their preferred communication medium when communicating with their fans or supporters. Monitoring their interactions across the X platform can reveal intentions, policies or affiliations. When public figures interact with or endorse certain accounts, it provides insights into their networks and potential influences.
The vast user base makes X crowded with posts and other multimedia content that can be analyzed to reveal people's opinions, mood shifts or identify emerging narratives in a specific geographical location, a community or in a country. This data helps predict social unrest or can help to measure public response to policy announcements.
Many cybersecurity professionals use X as a preferred social media platform to share discovered vulnerabilities and recent attacks. This makes it a critical resource for monitoring cyber threats. Security researchers often publish zero-day vulnerabilities on X before formal advisories are released, which gives OSINT practitioners early warnings about emerging threats.
An individual’s X account has two names. One is used to identify the user across the X platform, that is the username. The second name is the display name — which could be anything. The display name is not unique, which means the display name "John Doe" can be used on any number of X accounts.
The username, also known as the handle, starts with the @ symbol, does not contain spaces, and is located under the display name on an X profile. The username is unique to an account and appears in the profile URL.
For example, in Figure 1 below you can see the URL: http://www.x.com/onlineosint, where onlineosint is my X handle.
Figure 1 - X display name and handle
It is worth noting that the X handle/username can be changed; however, the new username must be available for successful change.
Accessing a public X profile (see Figure 2) will display different elements of the account, such as:
Profile image: This could be a personal photo of the individual or a company logo if the profile belongs to an organization. Some X accounts do not have a profile image.
Profile banner image (also known as the header image): The header image is displayed horizontally across the upper section of the X profile page.
Profile bio: Most X accounts have an associated bio that may include links to other social media platforms or direct links to websites managed by the X account holder. There is also optional information that appears for some profiles under the bio section, such as date of birth or location information.
Join date: The date when the account was created (month and year).
Followers and following: The number of other X accounts that follow this account, in addition to the X accounts that this account holder is following.
Posts: This section contains all posts made by this user on X.
Replies: All replies made by the user.
Highlights: If the X account is a premium user, their highlights will appear here.
Articles: If the X account user is Premium+ and has written articles, their articles will appear here.
Media: This section will display all media files (images and videos) uploaded by the user to the X platform. For example, when we post a tweet containing an image or video, the media files of all tweets will appear in this section.
Likes: When a user likes a tweet, their likes will appear in this section. It is worth noting that your likes are private; only you can see them.
Figure 2 - The X user profile page
As stated previously, an X display name can be anything. For many individual accounts, the display name is their real name. The X platform contains people from diverse nationalities and cultures, so inspecting the display name to see its meaning in other cultures or countries could reveal important information about the account holder. Here are two services for revealing names' meaning:
Figure 3 - Finding a name's meaning and origin using Behind the Name service
We can also use Google Dorks to find all instances where the target name on X is appearing online. Here are some Google dorks to assist in your search:
"index of" "Full Name"
intitle:"Full Name"
inurl:"Full Name"
"Full Name" ext:txt
ext:pdf "Full Name"
ext:doc "Full Name"
ext:txt "Full Name"
ext:xlsx "Full Name"
ext:pptx "Full Name"
"Full Name" intext:"confidential"
"Full Name" intext:"private"
"Full Name" intext:"SSN"
"Full Name" intext:"credit card"
"Full Name" intext:"bank account"
"Full Name" intext:"resume"
"Full Name" intext:"CV"
"Full Name" intext:"report"
"Full Name" intext:"document"
"Full Name" intext:"profile"
"Full Name" intext:"bio"
"Full Name" intext:"about"
"Full Name" intext:"contact"
"Full Name" intext:"data"
"Full Name" intext:"information"
"Full Name" intext:"details"
"Full Name" intext:"record"
"Full Name" intext:"log"
Inspecting X handle names is also important. For example, many people have the same username across different social media services. They will have the same username on X, Facebook, Instagram, and Reddit. We can perform a reverse username search to discover other social media accounts associated with the same X handle:
Next we should conduct a reverse image search for both profile and header images to see where these images appear online. It may help us discover new connected profiles on other social media services. Here are some services to execute reverse image searches:
Individual X profiles commonly use a personal image for their profile image. In those cases, you can use specialized search engines for faces:
Header images sometimes contain written characters and intricate details. If this is the case, you can use online enlargement services to clarify the header image's details. Here are some image enlargement services online:
The basic search functionality on X is located on the top right side of the page. Users can enter their keywords or hashtags and start searching within the X platform. The returned results will show a combination of posts, photos, accounts, and more (see Figure 4).
Figure 4 - X basic search
The returned results can be filtered into:
Clicking the more icon on the right-hand side of the search results page displays "Search settings" which contains two additional search filters (see Figure 5):
Figure 5 - Access X Search settings
We can also access the search filter options on the right side to filter returned results From anyone or People you follow, and the Location, to either Anywhere or Near you. From the same panel, we can access the Advanced search function.
To access Advanced search, you must first enter your search keyword in the X search box as we did previously.
Now, click on "Advanced search," located underneath "Search filters" in the upper right corner of your results page. A pop-up window will appear where you can further refine your search query as follows (see Figure 6).
Figure 6 - The X advanced search feature
Words (Keyword Filters)
Figure 7 - Search for hashtags
Figure 8 - Return tweets in a specific language only
Accounts
Filters
Replies – Includes or excludes replies in results.
Links – Tweets containing URLs.
Engagement – Minimum replies, likes, or reposts – Finds tweets with at least a specific number of interactions.
Example: min_retweets:100 >> Only tweets with 100+ retweets.
Dates (Time-based filters)
From / To – Searches tweets posted between two dates.
Example: OSINT until:2025-01-01 since:2024-01-01 | Search for all tweets containing the keyword OSINT that were posted between 2024-01-01 AND 2025-01-01
Although Google dork can help you locate information on the X platform, it is always advisable to use X's native advanced search features as they offer more specific filters for dates, users, engagement, and media. However, here is a list of relevant Google dorks you can use to find information on X:
There are also some third-party services that can be leveraged to find information within the X platform. Here are the most prominent ones:
Sentiment analysis involves assessing the emotional tone behind text posts. For X posts, this can help reveal public opinion trends, identify crises, or detect coordinated disinformation campaigns. For example, during political elections, monitoring shifts in sentiment across specific geographic regions can help predict voting outcomes before they occur.
Tools helpful for this purpose include:
All digital files contain metadata that holds some technical information about the file itself and its creator. Although X removes the most important metadata when uploading files to it, we may still encounter tweets that contain links (URLs) to digital files stored outside the X platform. Inspecting such files' metadata can provide valuable insights in many instances. There are different tools that aid OSINT gatherers in extracting metadata. Here are the most prominent ones:
Images posted to X often contain identifiable elements that can reveal geographical locations via:
Some tools to help us identify locations in images and videos:
Beyond visual analysis, geolocation data on X can be inferred through multiple methods beyond just EXIF metadata:
Analyzing user interactions on X can reveal influence networks, help detect coordinated disinformation campaigns, and uncover how narratives spread.
Here are some examples and tools to inspect user engagements on X:
Investigating deleted or private content on X presents unique challenges, as once content is removed, it is no longer publicly accessible via the platform's API or standard tools. However, OSINT gatherers can use alternative methods to recover or analyze such content. Here are two ways:
X Spaces is a live audio chat feature on X that lets users host or join real-time voice conversations, functioning like a live podcast or conference call on the X platform.
Any user can join, listen, and speak in a Space when using X on iOS and Android, though web users can only listen and cannot start a Space themselves.
All Spaces are public, similar to posts, meaning they're accessible to anyone. They automatically appear at the top of your Home timeline, and each Space has a shareable public link. Due to the public nature of Spaces, it's important to note that people may be able to listen to a Space without being visibly listed among the guests in that Space.
Spaces can be recorded and are attached to each X account. To see a list of Spaces of a specific X user, go to https://spacesdashboard.com/u/@username (replace the @username with the target X username. For example, https://spacesdashboard.com/u/elonmusk ) (see Figure 9)
X bots are automated or semi-automated accounts that resemble human behavior in posting and following X accounts. While some bots are harmless (e.g., news bots), others spread spam, scams, or are used to propagate disinformation.
Here are some methods to identify X bot accounts:
There are also some tools that can aid in detecting bot accounts such as:
Community Notes aims to create a better-informed world by empowering people on X to collaboratively add context to potentially misleading posts.
Contributors can leave notes on any post, and if enough contributors from diverse perspectives rate that note as helpful, it will be publicly displayed on the post. Community Notes are now publicly visible to everyone in the US. See Figure 10 below for a sample community note.
As we’ve demonstrated, X (formerly Twitter) is a great source for collecting digital evidence to support various investigation needs.
However, because evidence on X can disappear quickly, OSINT investigators should follow specific procedures when collecting evidence to ensure the defensibility of their findings:
WebPreserver is a social media and web capture tool that allows you to capture multimedia X posts, comment threads, or entire profiles and timelines in just a couple of clicks. The browser plug-in automatically expands threads and downloads multimedia, and autoscrolls timelines, saving you time from manually expanding and capturing every post. Better yet – all evidence collected is complete with the appropriate metadata, digital signatures for authentication, and can be exported in native formatting, so you can present your evidence in context.
Learn more about WebPreserver here.
X / Twitter remains a valuable OSINT resource, offering real-time information, rich user profiles, and diverse multimedia content. We’ve covered the essential techniques for extracting intelligence from X, including username analysis, profile inspection, advanced search methods, and analyzing posts.
If you use these strategies in conjunction with the suggested tools for sentiment analysis, geolocation, and metadata extraction, as well as strategies for investigating deleted content and detecting bot accounts, you’ll be ready to leverage X’s public nature and apply these OSINT methods to extract meaningful insights from the platform.