Mirror Channels: How to Detect Telegram's Fake Independent Sources in Four Steps
Mirror channels are the second-cheapest signal in public Telegram OSINT, and the cheapest to automate. A "mirror" is a channel that republishes another channel near-verbatim, usually minutes later, sometimes with a new logo and a patriotic sign-off. Analysts treat mirrors as independent sources. That's how you get 14 channels "confirming" a rumor that started in one. Detection is a solved problem…
Mirror channels in Telegram OSINT are cost-effective and easily automated. They replicate content from other channels almost word-for-word, often with a subtle change. Analysts generally consider these mirrors as independent sources, leading to multiple channels confirming the same rumor. To identify these fake independent sources, there are four steps:
1. Normalize and analyze text: Clean each post by removing emojis, punctuation, and converting to lower case. Cut the text into 3-word phrases called shingles and compute a unique hash for each shingle. Calculate the Jaccard similarity between a mirror's shingle set and the original post's set; a similarity above 0.7 indicates a potential mirror.
2. Measure timestamp-lag: For each high-similarity pair, calculate the time difference between the posts. Mirrors have a consistent, tight, and stable positive lag (2-15 minutes) for all posts. Authentic independent confirmations have noisy lag, different wording, and a similarity below the shingle threshold.
3. Watermark the origin: When a mirror pair is identified, keep the earliest post and tag the rest as mirror_of: ID. Only alert on the origin post, reducing alert fatigue caused by duplicate notifications in warzone monitoring.
4. Use lag as intelligence: If a mirror family has a consistent lag for an extended period but suddenly posts significantly sooner, it could indicate a change in coordination or an origin handover. The lag provides valuable information about possible coordination shifts within a media cluster.
The detection process runs on the public t.me/s/ preview layer, using only text, timestamps, and post IDs. No API or logins are required. The duplication threshold, lag-window parameters, and the collapse-and-tag pipeline are included in the Telegram & Web OSINT Bundle for $5. A free sample brief is available to showcase the output format, and the entire process runs for free on GitHub Actions, without the need for a server or paid APIs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
