Source Byte

it just doesn't make sense.

𝐅𝐢𝐧𝐝 𝐚𝐥𝐥 𝐩𝐫𝐢𝐯𝐚𝐭𝐞 𝐠𝐫𝐨𝐮𝐩𝐬 𝐜𝐫𝐞𝐚𝐭𝐞𝐝 𝐛𝐲 𝐚 𝐓𝐞𝐥𝐞𝐠𝐫𝐚𝐦 𝐮𝐬𝐞𝐫 𝐮𝐬𝐢𝐧𝐠 𝐭𝐡𝐞𝐢𝐫 𝐓𝐆 𝐈𝐃!

This method is extremely handy for SOCMINT investigations and can potentially reveal all private groups created by a specific Telegram user.

When Telegram generates an invite link prefix for private groups, it translates the user ID into a 32-bit hexadecimal value and then encodes it using a base64 algorithm. The resulting invite link structure looks like this:

𝐭.𝐦𝐞/𝐣𝐨𝐢𝐧𝐜𝐡𝐚𝐭/𝐛𝐚𝐬𝐞64_𝐕𝐚𝐥𝐮𝐞

Alright… here’s how you do it. Say we have the following 𝐓𝐆 𝐈𝐃: 1111111111
Using e.g. Cryptii, simply insert the TG ID as input and convert it to a 32-bit hex string.
𝐓𝐡𝐞 𝐫𝐞𝐬𝐮𝐥𝐭𝐢𝐧𝐠 32-𝐛𝐢𝐭 𝐡𝐞𝐱 𝐢𝐬: 42 3𝐚 35 𝐜7
https://cryptii.com/pipes/integer-encoder


Next, with CyberChef, encode the 32-bit hex as base64.
𝐓𝐡𝐞 𝐫𝐞𝐬𝐮𝐥𝐭 𝐢𝐬: 𝐐𝐣𝐨1𝐱𝐰
https://gchq.github.io/CyberChef/

Since private chat invite URLs only consist of 5 characters, we remove the last character, leaving us with Qjo1x.

All private invite links follow this structure:
𝐭.𝐦𝐞/𝐣𝐨𝐢𝐧𝐜𝐡𝐚𝐭/𝐐𝐣𝐨1𝐱

Now, you can search for this in your preferred search engine:
"𝐭.𝐦𝐞/𝐣𝐨𝐢𝐧𝐜𝐡𝐚𝐭/𝐐𝐣𝐨1𝐱"

𝐁𝐨𝐧𝐮𝐬 𝐓𝐢𝐩:
You can also check the URL with the Wayback Machine to see if there are any archived versions of the target URL.

𝐡𝐭𝐭𝐩𝐬://𝐰𝐞𝐛.𝐚𝐫𝐜𝐡𝐢𝐯𝐞.𝐨𝐫𝐠/𝐰𝐞𝐛/*/𝐭.𝐦𝐞/𝐣𝐨𝐢𝐧𝐜𝐡𝐚𝐭/𝐐𝐣𝐨1𝐱/*

credits : Valdemar B.