SUMMER INTERNSHIP

GUIDELINES
Reports

SET, SU
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

SUMMER INTERNSHIP
B. TECH 3rd YEAR PASSING STUDENTS

TELEGRAM OSINT: A SYSTEM FOR REAL-TIME THREAT

INTELLIGENCE AND MONITORING
Summer Internship Report
Submitted to
Sharda University

In partial fulfillment of the requirements of the award of the

Degree of Bachelor of Technology

in
Computer Science and Engineering
by

Pushkar Dangwal

Under the mentorship of

Dr. Avinash Kumar

Assistant Professor

Department of Computer Science and Engineering

School of Engineering & Technology
Sharda University
Greater Noida
July, 2025
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

DECLARATION OF THE STUDENT

We hereby declare that the project entitled is an outcome of our own efforts under the guidance
of Dr. Avinash Kumar. The project is submitted to the Sharda University for the partial
fulfilment of the Bachelor of Technology Examination 2025-26.
We also declare that this project report has not been previously submitted to any other
university.

Pushkar Dangwal 2201010540

Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

CERTIFICATE

This is to inform that Pushkar Dangwal of Sharda University has successfully completed the
project work titled Telegram OSINT: A System for Real-Time Threat Intelligence and
Monitoring in partial fulfilment of the Bachelor of Technology Examination 2025-2026 by
Sharda University.
This project report is the record of authentic work carried out by them during the period from

Pushkar Dangwal (2201010540)

Dr. Avinash Kumar

Assistant Professor

Dr. Sudeep Varshney

HoD, SSET
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

LIST OF TABLES
Table 1: Literature Survey
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

LIST OF FIGURES
Figure 1: Landing Page
Figure 2: Landing Page (Scrolled)
Figure 3: Channel Analysis
Figure 4: Keyword Search
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

ABSTRACT
The creation and deployment of the Telegram OSINT system, a comprehensive cybersecurity
intelligence platform intended for Open Source Intelligence (OSINT) collection from the
Telegram messaging service and real-time threat identification, are described in depth in this
study. This project's main goal was to develop a powerful tool that automatically monitors,
analyzes, and visualizes possible security risks across a large number of user-defined Telegram
channels. This was achieved by designing a two-part system with a React TypeScript frontend
for user interaction and data display and a Python Flask backend for data processing. The
backend provides instant risk assessment by utilizing a multilingual BERT model for complex
sentiment analysis and the Telethon library for live channel monitoring. Users can view a live
stream, access extensive data, and do detailed searches on the frontend's dynamic dashboard
with a cyber motif. The end product is a potent, non-blocking OSINT tool that effectively
connects real-time data gathering with actionable threat intelligence, giving researchers, law
enforcement, and cybersecurity experts a major edge.

.
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

ACKNOWLEDGEMENT
I would like to express my deepest appreciation to all those who provided
me the possibility to complete this report. Apart from the efforts of myself, the
success of any project depends largely on the encouragement and guidelines of
many others. We take this opportunity to express my gratitude to the people who
have been instrumental in the successful completion of this project. We would
like to show my greatest appreciation to Dr. Avinash Kumar. We can’t say thank
you enough for her/his tremendous support and help. We feel motivated and
encouraged every time we attend her meeting. Without her encouragement and
guidance this project would not have materialized. The guidance and support
received from all the members who contributed and who are contributing to this
project, was vital for the success of the project. We are grateful for their constant
support and help. Besides, we would like to thank the authority of Sharda
University for providing us with a good environment and facilities to complete
this project. Finally, an honourable mention goes to our families and friends for
their understandings and supports on us in completing this project. Without helps
of the particular that mentioned above, we would face many difficulties while
doing this.
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

TABLE OF CONTENTS
Sr. No. Contents Page No.
Title Page 2

Declaration of the Student 3

Certificate of the Guide 4
List of Tables 5
List of Figures 6
Abstract 7
Acknowledgement 8
1 INTRODUCTION 10
1. Problem Statement
2. Hardware Specification
3. Software Specification
4. Motivation
5. Objectives
6. Contributions
7. Summary
2 LITERATURE SURVEY 13
1. Related Work

3 DESIGN AND IMPLEMENTATION 14

8. Methodology
9. Design
10. Implementation

4 RESULT AND DISCUSSIONS 18

1. Results

5 CONCLUSION 19
1. Conclusion
2. Limitations
3. Future Scope

6 REFERENCES 20
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

1. Introduction
a. Problem Statement
• Existing cybersecurity workflows mostly lack real-time threat identification from Telegram
channels, which causes coordinated threat campaigns and delayed knowledge of malicious
conversations.

• There is no automation for ongoing background data gathering and risk assessment, making
manual monitoring of high-risk Telegram groups ineffective and non-scalable.

• Since integrated sentiment analysis and polarity scoring are not available in current threat
intelligence systems, it is challenging to determine the seriousness and intent of Telegram
communications.

• Traditional OSINT solutions lack metadata-rich inspection capabilities, advanced filtering,

and hybrid search, which restricts the ability to conduct in-depth forensic research of threats
originating from Telegram.

• The restrictions of the Telegram API, like rate-limiting and session instability, make it
difficult to create a reliable and continuous monitoring system.

b. Hardware Specifications
• Processor: Quad-core CPU (e.g., Intel Core i5 8th Gen or AMD Ryzen 5)
• RAM: 8 GB DDR4
• Storage: 256 GB SSD
• Network: Stable broadband connection (≥10 Mbps)

c. Software Specifications
Backend (Python Flask)

• Flask: Lightweight web framework used to build RESTful APIs for the frontend.

• Telethon: Python library to interact with Telegram’s API and fetch messages from
public channels.

• transformers (HuggingFace): Used to load pre-trained multilingual BERT models for

sentiment analysis.

• Pandas: Handles CSV caching, Excel channel configuration parsing, and in-memory
data processing.

• ThreadPoolExecutor: Manages background tasks like real-time channel polling

without blocking API responses.
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

Frontend (React + TypeScript)

• React: JavaScript library used for building the component-based UI.

• TypeScript: Provides type safety and better development tooling in the frontend
codebase.

• Tailwind CSS: Utility-first CSS framework for building a responsive, cyber-themed

dark UI.

• Axios: Handles HTTP requests from frontend to Flask API for real-time data.

• Chart.js or Recharts: Renders interactive charts for sentiment trends and activity
analytics.

d. Motivation
Telegram has quickly become a popular medium for unrestricted communication, but it has
also developed into a focal point for data leaks, extremist propaganda, and cybercrime.
Telegram is a real-time source of actionable cybersecurity knowledge that is frequently
overlooked or underutilized by traditional threat intelligence platforms. By creating an
automated OSINT platform that uses Telegram data for real-time threat monitoring and
analysis, this initiative seeks to close that gap. The following are some of the main reasons
TelegramOSINT was developed:

• Unmonitored Threat Landscape: Threat actors are using Telegram more and more to
coordinate, but traditional security solutions are still not keeping a close enough eye on it.

• Need for Real-Time Intelligence: Security teams now want dynamic, real-time
information to react proactively to attacks; static analysis is no longer adequate.

• Lack of Centralized OSINT Tools: Existing tools do not provide a unified interface
combining live feed monitoring, sentiment analysis, and threat scoring specifically for
Telegram.

• Manual Monitoring is Impractical: Human monitoring is ineffective and prone to

mistakes because of the volume and pace of communication on Telegram.

• Growing Demand in Cybersecurity Operations: More and more, researchers, SOCs, and
law enforcement are looking for platform-specific, automated, and adjustable open-source
intelligence tools.
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

e. Objectives
• To develop a system that continuously scans open Telegram channels for possible
cybersecurity risks.
• To use a pre-trained BERT model to automatically analyze sentiment in Telegram
messages.
• To offer an intuitive dashboard for displaying channel activity, trends, and threats.
• To make keyword-based live feed monitoring with sorting and filtering capabilities
available.
• To use threat scoring to identify and prioritize harmful channels and high-risk messages.

f. Contribution
Under the supervision of my mentor, I designed and developed the TelegramOSINT system on
my own. I constructed a Flask-based backend for processing and sentiment analysis using
BERT, integrated Telethon for real-time message scraping from Telegram channels, and made
a responsive React TypeScript frontend for visualizing threats and channel activity. To
guarantee effective and scalable monitoring, I put in place background multithreaded data
fetching, CSV-based caching, and Excel-driven channel configuration. I improved data flow
between components, streamlined system design, and produced a strong OSINT platform for
real-time cybersecurity threat identification and analysis while working with my mentor.

g. Summary
A real-time threat intelligence and monitoring tool called TelegramOSINT was created to look
for cybersecurity threats in open Telegram chats. It offers continuous data collection, sentiment
analysis with BERT, and sophisticated threat visualization by fusing a React TypeScript
frontend with a Python Flask backend. For non-blocking performance, messages are handled
in the background utilizing multithreading after being obtained via the Telethon API and saved
in CSV caches for offline access. The system provides keyword-based live monitoring, threat
scoring, and channel activity tracking, and it leverages Excel files for dynamic channel design.

Live feed inspection, filtering, and in-depth message analysis via interactive modals are made
possible by the frontend's dark-themed, responsive dashboard, which was constructed with
Tailwind CSS. It offers real-time analytics, including seven-day activity trends, risk rating,
and sentiment distribution. TelegramOSINT responds to the increasing demand for scalable,
useful OSINT solutions in cybersecurity operations, law enforcement, and scholarly research
by automating the identification and categorization of high-risk information.
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

2. Literature Survey
Title & Year Authors Core Idea Key Findings Relevance
Demonstrates
For penetration how crucial
Creation of testers, transparency ethical, open-
Python-based, is essential; source OSINT
Cybercheck transparent, platforms that can be technologies are,
– OSINT & and adaptable customized stop which directly
Web OSINT tools unethical use; and supports a
Vulnerability Shamunesh P, to lessen Python is great for transparent
Scanner Vinoth S, L N B reliance on cybersecurity TelegramOSINT
(2023) Srinivas other services. automation. strategy.
Analysis of Exemplifies the
malware VirusTotal importance of
detection outperformed other multi-source
before and free programs; analysis, which
Developing after steganography is pertinent to
Malware and steganography lowers detection Telegram
Analyzing it Mrinal Kaushik, using different rates; many OSINT monitoring
with OSINTs Monica Malik, OSINT sources enhance across multiple
(2020) Bhawna Narwal technologies. detection. channels.
It offers verified
Determining techniques for
reply BERT obtained a Telegram
Identifying relationships 76.19% F1 score and message
Reply in Telegram performs well in analysis and
Relationships groups by brief Telegram chats BERT
from Panpan Zhang, applying thanks to user implementation,
Telegram Yao Qi, BERT and context capabilities making it
Groups Yanzeng Li, et multi-feature that get around word immediately
(2021) al. fusion. limits. applicable.
Mining Semantic Eighty percent of the Supports a
Textual Data analysis and data is unstructured sentiment
to Boost Federico Neri, multilingual and textual. Support analysis method
Information Paolo Geraci OSINT are for multiple and offers a
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

Access in features of the languages is crucial; basis for textual

OSINT SYNTHEMA For OSINT, analysis in
(2009) SPYWatch semantic analysis is OSINT.
system. essential.
Confirms the
Extensive 98% accuracy is validity of
OPEN EYE: OSINT attained; automation contemporary
Information system that lowers errors; OSINT design
Gathering includes social integration increases ideas and backs
Tool Using A.M.Sermakani, media accuracy; and an automated,
OSINT P.Sreejith, algorithms ethical moral threat
Framework A.Leela and Google considerations are identification
(2024) Krishna, et al. Dorks. crucial. methodology.
Table 1: Literature Survey

3. Design and Implementation

a. Methodology
• Channel Configuration

• An Excel (.xlsx) file contains the URLs of Telegram channels.

• When the program starts, these channels are processed and verified.

• Telegram API Integration

• The system connects to Telegram via API_ID and API_HASH using the Telethon
library.

• It retrieves messages from configured public channels and authenticates using a saved
session.

• Data Fetching (Light/Full Mode)

• Recent messages are continuously fetched by a background thread (for example, the
last three or 2000 per channel).

• Messages are periodically retrieved without interfering with the frontend or API.

• Data Preprocessing and Caching

• Messages undergo preprocessing, such as metadata extraction and text cleaning.

Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

• Pandas DataFrames are used to cache processed messages in memory and store them
in CSV files.

• Sentiment Analysis

• To ascertain sentiment (positive, neutral, or negative) and polarity confidence, every

communication is run through a pre-trained BERT multilingual model.

• Content length and keywords, as well as sentiment, are used to calculate a risk score.

• API Layer (Flask Backend)

• Flask provides RESTful endpoints for:

o Fetching live/cached messages

o Triggering full updates

o Serving statistics and sentiment charts

• Frontend Visualization (React + TypeScript)

• React-based dashboard displays:

o Live message feed

o Filtering by sentiment, date, channel

o Channel activity, sentiment trends, and threat rankings

• Tailwind CSS is used for styling and responsive layout.

b. Design
1. Channel Configuration Layer

• Maintains the list of Telegram channels under observation using an Excel (.xlsx) file.

• At startup, channels are verified and loaded into memory so that the background fetcher
can access them dynamically.

2. Data Collection Layer

• Uses session-based authentication to connect to the Telegram API using Telethon..

• Retrieves messages from every public channel that has been configured, either in full
mode (up to 2000 messages) or light mode (latest 3 messages).

• Uses a ThreadPoolExecutor to guarantee parallelized, non-blocking message retrieval.

Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

3. Data Preprocessing & Caching Layer

• Retrieves the timestamp, sender ID, content length, and channel name from the message
metadata.

• Stores the findings in an in-memory Pandas DataFrame after applying minimal text
cleaning.

• Messages are periodically saved to CSV files for offline storage and analysis.

4. Sentiment Analysis Engine

• HuggingFace Transformers' pre-trained BERT multilingual model is used to assess the

sentiment of messages.

• Assigns a polarity confidence score and a sentiment label (positive, neutral, or negative)
to every communication..

• Using sentiment polarity, keywords, and message length, it calculates a risk score.

5. Frontend Presentation Layer (React + TypeScript)

• Developed using React and Tailwind CSS to ensure a modern, responsive user
experience.

• Displays:

o Real-time message stream featuring channel tags and sentiment badges.

o Modals for full message inspection and metadata display.

o An analytics dashboard with sentiment distributions, threat rankings, and

activity trends.

• Contains options for sorting, sentiment, date, and length filtering, as well as advanced
search.

6. User Interaction & Monitoring Layer

• Notifies users of background activity through toast alerts and live update indications.

• Makes it possible to manually refresh and modify fetch intervals.

• Monitors channel activity, including trends in message volume and last seen
timestamps.
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

c. Implementation
a. Telegram API Setup

• To get API_ID and API_HASH, sign up for a Telegram app.

• Use Telethon for authentication, then save the session for future use.

b. Channel Configuration

• Make an Excel document with the URLs of the Telegram channels.

• Upon application starting, load and verify channel data.

c. Backend Development (Flask)

• Set up Flask API routes to offer messages, statistics, and updates.

• To retrieve background messages, use ThreadPoolExecutor.

d. Sentiment Analysis Integration

• Use HuggingFace to load a pre-trained BERT multilingual model.

• Examine every communication and provide confidence scores along with sentiment
labels.

e. Data Storage and Caching

• In-memory DataFrames are used to store processed messages.

• For offline access, occasionally save data to CSV files.

d. Summary
By loading channel URLs from an Excel file and retrieving messages using the Telethon API,
the TelegramOSINT system keeps an eye on open-source intelligence on public Telegram
channels. Pandas is used to preprocess and cache the messages after they are retrieved in
bulk and in real time. A pre-trained BERT multilingual model is used to evaluate each
message in order to assess sentiment and generate a risk score. While a React + Tailwind
CSS interface shows live feeds, sentiment trends, and channel activity with filtering, search,
and analytics capabilities, a Flask-based API provides this data via REST endpoints.
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

4. Result
The end product is a working OSINT web application that can monitor public Telegram
channels in real time and was developed using React and TypeScript. It offers sentiment-based
threat analysis, a live message feed, and interactive dashboards that show content trends, risk
levels, and channel activity. Through a clear and responsive user interface, the software helps
cybersecurity professionals to rapidly search, filter, and evaluate Telegram data, transforming
unprocessed information into actionable intelligence.

Fig 1: Landing Page

Fig 2: Landing Page (Scrolled)

Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

Fig 3: Channel Analysis

Fig 4: Keyword Search

5. Conclusion
a. Conclusion
To sum up, this project, which I worked on during my internship, gave me invaluable practical
experience creating a full-stack OSINT platform specifically designed for Telegram's real-time
threat monitoring. I created and executed every element with the help of my mentor, from
sentiment analysis and backend message scraping to a responsive frontend dashboard for data
visualization. In addition to improving my Flask, React, and NLP abilities, the project helped
me better comprehend the cybersecurity issues surrounding open-source intelligence. The
finished system demonstrates both technological advancement and significant internship
Session: _____________Dept:_________________ Project No.:_________Date of Evaluation:___________

contribution by providing a workable and expandable solution for monitoring high-risk

Telegram communications.

b. Limitations
• Private groups and one-on-one conversations are not monitored by the system; it only
keeps an eye on public Telegram channels.
• Sentiment analysis might not always be precise, particularly for brief or non-English
messages.
• During periods of high activity, the Telegram API's rate constraints may cause message
fetching to lag.
• The system relies on an Excel file for manual channel setting, which could not be
scalable for big deployments.
• There is no integrated alert system (such as emails or SMS) to notify users of high-risk
messages.

c. Future Scope
• Integrated support for private chats and groups with admin access or Telegram bot
tokens.
• Increase the precision of sentiment analysis using language detection and specially
trained models.
• Include real-time alerting systems for high-risk messages, including webhook
notifications, SMS, or email.
• For improved scalability and querying, switch from CSV storage to a database system
(such as MongoDB or PostgreSQL).
• For safe multi-user use, implement role-based access and user authentication.

6. References
1. Telethon: https://docs.telethon.dev
2. Flask: https://flask.palletsprojects.com
3. Hugging Face Transformers (BERT): https://huggingface.co/docs/transformers
4. React: https://react.dev
5. https://ieeexplore.ieee.org/document/10212207
6. https://ieeexplore.ieee.org/document/9391067
7. https://ieeexplore.ieee.org/document/9617045
8. https://ieeexplore.ieee.org/document/5196099
9. https://ieeexplore.ieee.org/document/11026654