Resistance Survival Guide #220:
Extremist movements rarely organize only in public view anymore. Over the past several years, many far-right networks, militias, conspiracy ecosystems, and propaganda operations have migrated to messaging platforms that allow large channels, encrypted communication, and minimal moderation. One of the most widely used platforms for this activity is Telegram. The app hosts thousands of channels where propaganda is distributed, misinformation campaigns are coordinated, and real-world actions are sometimes discussed or promoted.
For researchers, journalists, and activists, understanding how these ecosystems operate online is an important part of documenting extremist activity. Monitoring open channels using open-source intelligence (OSINT) techniques allows investigators to track narratives, identify coordination patterns, and preserve evidence before posts are deleted.
This type of monitoring is not about harassment or infiltration. Responsible OSINT work focuses on observation, documentation, and pattern analysis. When done carefully, it helps journalists expose disinformation networks, allows watchdog groups to identify emerging threats, and helps communities understand how extremist narratives move from fringe spaces into mainstream political discourse.
Skill Level: Intermediate
Why This Matters
Extremist groups rely heavily on digital ecosystems to grow. Telegram channels allow administrators to broadcast messages to thousands of followers instantly, making the platform ideal for spreading propaganda, conspiracy theories, and calls for mobilization. Messages and graphics can be reposted rapidly across dozens of channels, creating coordinated campaigns that amplify specific narratives.
Researchers studying extremist movements often observe how misinformation spreads in waves. A narrative may appear first in a small Telegram channel, then spread across similar communities, and eventually migrate to larger social platforms where it reaches a broader audience. Understanding where these narratives originate allows journalists and watchdog groups to identify coordinated messaging campaigns early.
Organizations such as the Anti-Defamation League, Bellingcat, and the Global Network on Extremism & Technology have produced extensive research on how extremist communities operate online. Their work shows that careful monitoring of open channels can reveal patterns in recruitment, propaganda distribution, and event coordination.
Helpful research resources include:
- Anti-Defamation League Center on Extremism
https://www.adl.org/resources - Bellingcat investigative guides and tools
https://www.bellingcat.com/resources/ - Global Network on Extremism & Technology research library
https://gnet-research.org/
Studying these networks helps build a clearer picture of how online radicalization works and how coordinated propaganda campaigns spread.
What This Tool Is
Open-source intelligence (OSINT) refers to the practice of collecting information from publicly available sources. These sources include social media posts, public databases, websites, satellite imagery, and messaging platforms where content can be viewed without hacking or accessing private systems.
Telegram has become a particularly valuable platform for OSINT researchers because many extremist channels operate publicly. Anyone can view these channels and observe how information flows between communities.
Researchers often combine Telegram monitoring with OSINT tools that help organize and analyze information. One widely used resource is the OSINT Framework, which provides a directory of investigative tools used by journalists and analysts.
OSINT Framework investigative tool directory: https://osintframework.com/
Another valuable resource is the Bellingcat Online Investigation Toolkit, which compiles tools commonly used in digital investigations.
Bellingcat Online Investigation Toolkit: https://www.bellingcat.com/resources/2024/09/24/bellingcat-online-investigations-toolkit/
Using these resources, investigators can track narratives, archive posts, map networks, and analyze digital ecosystems.
Step-by-Step Instructions
Step 1: Create a Separate Research Account
Before monitoring Telegram channels, create a dedicated account used only for research. This protects your personal identity and prevents your private contacts or personal information from being exposed in extremist spaces.
Download Telegram from the official website: https://telegram.org
Using a separate account also helps maintain professional boundaries while conducting research. Avoid engaging with users, posting messages, or interacting with channels. Monitoring should remain observational.
Step 2: Locate Public Channels
Once your research account is set up, begin identifying channels that discuss extremist ideology, propaganda, or political mobilization. Telegram’s search feature allows users to find public channels by keywords, hashtags, or organization names.
Researchers often track channels connected to:
- militia movements
- conspiracy networks
- extremist propaganda outlets
- disinformation campaigns
Journalists and research organizations sometimes publish lists of channels connected to extremist movements, which can provide useful starting points for investigation. The goal is not to monitor a single channel but to observe how networks of channels interact with one another.
Step 3: Observe Communication Patterns
After identifying relevant channels, begin paying attention to patterns rather than focusing on individual posts. Extremist ecosystems often repeat specific talking points or propaganda narratives across multiple channels.
Look for patterns such as:
- identical graphics appearing in multiple channels
- synchronized messaging around political events
- calls for protests, rallies, or demonstrations
- cross-posting between administrators
When several channels begin repeating the same narrative at the same time, it may indicate coordinated messaging. These patterns are often more revealing than individual posts.
Step 4: Archive Important Content
Content on messaging platforms can disappear quickly. Posts are frequently deleted, channels are taken down, and administrators may remove evidence after controversies emerge. Archiving tools help preserve this information before it disappears.
Two widely used tools include:
- Internet Archive Wayback Machine https://archive.org/web/
- Archive.today https://archive.ph/
Researchers often save screenshots, archive links, and document timestamps so that evidence can be verified later. Proper documentation is essential for investigative work.
Step 5: Cross-Reference Other Platforms
Extremist messaging rarely stays contained to a single platform. Telegram narratives often spread to other social networks, podcasts, fringe forums, and video platforms.
Cross-referencing helps identify how propaganda moves across the internet. Researchers may compare Telegram posts with:
- social media posts
- fringe message boards
- video platforms
- public event announcements
When the same message appears across multiple platforms, it suggests a coordinated campaign rather than a random discussion.
Step 6: Report Responsibly
If monitoring reveals credible threats or organized activity related to violence, documentation should be handled responsibly.
Rather than confronting individuals or amplifying extremist messaging, researchers should focus on documenting evidence and sharing findings with appropriate organizations. Journalists, watchdog groups, and law enforcement agencies often rely on publicly documented evidence when investigating extremist activity. Responsible reporting helps maintain credibility and prevents misinformation from spreading further.
Example
Researchers studying extremist propaganda during election cycles often observe coordinated messaging campaigns. A narrative may first appear in a small Telegram channel, then spread through dozens of related channels before appearing on mainstream social platforms.
By identifying these narratives early, journalists and fact-checking organizations can prepare responses and inform the public before misinformation spreads widely.
In several cases, investigative journalists have uncovered planned demonstrations or coordinated harassment campaigns by tracking conversations in open Telegram channels. This demonstrates how open-source monitoring can provide early warning signals about organized online activity.
Required Reading
If you want to develop stronger OSINT investigation skills, these resources provide valuable training materials and research guides.
- Bellingcat investigative resources
https://www.bellingcat.com/resources/ - OSINT Framework investigative tool directory
https://osintframework.com/ - Global Network on Extremism & Technology research reports
https://gnet-research.org/ - Anti-Defamation League extremism research archive
https://www.adl.org/resources
These organizations publish detailed reports on extremist ecosystems and digital propaganda networks.
Conclusion
Extremist movements increasingly rely on digital spaces to organize, recruit, and spread propaganda. Platforms like Telegram provide large broadcasting channels where these networks can coordinate messaging and mobilize supporters.
Monitoring these spaces using open-source intelligence techniques helps researchers document extremist activity, identify coordinated narratives, and preserve evidence before it disappears.
Citizen researchers, journalists, and watchdog organizations play an essential role in exposing these networks. Careful observation, responsible documentation, and ethical reporting can shed light on digital ecosystems that would otherwise remain hidden. Understanding how extremist movements operate online is one of the most important steps toward countering them.
Kitty’s Resistance Projects
- Resistance Directory: https://resistancedirectory.com/
- EpsteinWiki: Epsteinwiki.com
Support Resistance Kitty’s Work
- Kitty Merch: https://tr.ee/–Pu9s-BUL
- Support Kitty: https://buymeacoffee.com/resistancekitty
