Is this campaign coordinated?
Dozens of new accounts repeat the same accusation within hours. We test whether they act as one network and whether it has been used before.
X (Twitter) Account OSINT Investigation
An X (Twitter) account OSINT investigation tells you whether the accounts attacking your brand or your CEO are one angry person, a paid amplification network or a scam crew borrowing your name, and preserves what they posted before it is deleted.
- Bot and amplification networks
- Impersonation of brands and executives
- Archived, hashed posts
- Lawful purpose checked before we start
Short answer
An X (Twitter) account OSINT investigation examines public profiles, posts, reposts, follower overlap and account history to establish who or what is behind a campaign: a coordinated network, an impersonator or an identifiable person. OSINT-S archives every relied-on post, grades each attribution as confirmed, likely or possible, and takes cases only for a lawful purpose.
What an X Account OSINT Investigation Can Answer
Most X cases we take are about organizations and the people who run them: coordinated attacks, impersonation, false claims and threats.
Who is posing as us?
Fake support accounts, or a cloned CEO profile promoting a crypto giveaway.
Executive impersonation →Who started the false claim?
The first post, the accounts that spread it and the record your lawyer needs to choose the next step.
Is the risk escalating?
Threatening replies to an executive, and whether security should act now.
Executive protection →Bot Networks and Coordinated Inauthentic Behavior
No single signal proves coordination. We look for several independent ones lining up across the same group of accounts and report the strength of each.
| Signal | What it suggests | How much weight it carries |
|---|---|---|
| Creation dates clustered in days or weeks | Accounts registered in a batch | Moderate; real communities also join after news events |
| Identical or lightly edited text | A shared script or content supplier | Strong when the phrasing is unusual |
| Synchronized posting and reposting | Scheduling tools or a single operator | Strong when repeated across several bursts |
| Shared amplifiers and follower overlap | A network that boosts its own members | Moderate to strong |
| Handle and display-name history | Recycled accounts repurposed from earlier campaigns | Strong context, weak identification |
| Stolen or generated profile images | Accounts that do not belong to real people | Strong for inauthenticity, not for authorship |
The result is a network map: which accounts lead, which only repeat, what else the network has promoted, and whether it looks like a paid amplification service or one person running several accounts. A paid network is usually reported for removal; a single operator may be a legal matter.
Impersonation, Defamation and X's Own Rules
X prohibits impersonation meant to deceive and requires parody, commentary and fan accounts to label themselves. Our evidence is organized so you can use X's reporting route and, if needed, legal action.
X's impersonation policy says users "may not impersonate other identities of individuals, groups, or organizations to deceive others." Parody, commentary and fan accounts are allowed only if they carry a label, avoid the same avatar and put a term such as "parody" or "fan" at the start of the account name and in the bio. Severe violations lead to permanent suspension; if an account is posing as you or your brand, X offers a dedicated report form (X Help Center).
Suspension removes the account, not the operator, who often returns under a new handle. We record identifiers that survive a suspension, such as images, phrasing, linked sites and payment details. Recurring cases fit better into fake social media account removal work.
Archiving X Posts as OSINT Evidence
Posts are captured with the full thread, URL, post ID, UTC timestamp and a hash, before deletion, so the record survives if the account disappears.
Accounts behind campaigns delete posts once they draw attention. We capture threads in context, including replies and quoted posts, with media in original resolution, and log each capture so it can be checked later; the method is described on our social media evidence capture page.
Collection is scoped to the question rather than to everything an account ever posted. Large-scale access to X data is metered: X's developer documentation describes pay-per-use pricing in which post reads are charged per resource returned, with a monthly cap on post reads for pay-per-use plans (X API pricing). A targeted archive is usually cheaper and more useful in court than a bulk download.
Attribution Limits: What OSINT on X Cannot Prove
Public data can often link an account to a person or a network, but it cannot show who was typing. We state the confidence level and what would raise it.
- Public traces only. Email addresses, phone numbers and login IP addresses tied to an account are held by X. They are released through legal process, not through OSINT.
- Sold accounts. Aged accounts change hands, so a handle's past owner may not be its current operator.
- Commissioned campaigns. We can often show that a paid network was used. Proving who paid for it usually needs disclosure from the vendor or the platform.
- Common handles. A matching username elsewhere is a lead, not a finding; our username investigation page explains how reuse is tested.
Deeper identification work runs as anonymous account attribution, using the principles of the Berkeley Protocol for verification and preservation.
What We Will Not Do
We check the purpose of every request before accepting it, and we decline work aimed at private individuals for personal reasons.
- No unmasking of whistleblowers, journalists' sources, critics or satirists exercising lawful speech.
- No home addresses of private individuals, and no help finding a person who does not want to be found.
- No fake accounts to follow protected profiles, no requests for direct messages under a false identity, no account access and no purchased leaked data.
- If a case suggests abuse, stalking or a protective order, we decline it and point the person to the police and support services.
Findings go to your lawyer or security team for a lawful next step.
Deliverables and Timelines for an X OSINT Investigation
A short answer first, then the network map, the archived posts and the confidence of every attribution. Focused cases take from 10 business days.
| Case | You receive | Typical timeline |
|---|---|---|
| Urgent preservation | Archive of at-risk posts and accounts | Often within a business day |
| Impersonation or single account | Account history, linked assets, attribution grade, takedown evidence | From 10 business days |
| Coordinated campaign | Network map, lead accounts, prior activity, recommended response | Two weeks to about a month |
Every report is checked by a senior analyst before delivery. The quote is fixed after written scoping, urgent delivery costs 50% more, and the fee goes down if we miss the agreed date. X work is part of our wider social media investigations and of the OSINT services we run for brands and executives.
Send Us the Accounts and the Deadline
List the handles or post links, what happened and the decision you face. We confirm the purpose, start preservation where needed and reply with a fixed quote.
X Account Investigation FAQ
Hundreds of new accounts started attacking our CEO on X overnight — can an X (Twitter) account OSINT investigation tell us whether it's a bot network or real people, and who is behind it?
Usually it can tell coordination from organic anger. We test creation dates, shared wording, synchronized posting and shared amplifiers across the accounts and map which ones lead the campaign. Identifying who commissioned a paid network is harder: public data often shows the network and its earlier clients, while the buyer usually needs platform or vendor disclosure through legal process. The report grades each finding as confirmed, likely or possible.
Someone made an X account using our company logo and is replying to customers with a fake support link — what can you find out, and will it help us get the account removed?
We archive the account and its replies, check the linked site and any payment or contact details, and look for sibling accounts run the same way. X prohibits impersonation meant to deceive and offers a report form for accounts posing as you or your brand, and the evidence pack is organized for that route.
An anonymous X account posted claims about our firm that our lawyers think are defamatory — can you identify the person well enough for us to sue them?
Sometimes. Public links such as reused handles, linked websites, original image sources and posting patterns can point to a person, and we state how confident that link is. Data that ties the account to an individual, such as the sign-up email or IP logs, sits with X and is obtained through a court order.
We're worried the accounts attacking us will delete everything once we complain to X — how quickly can you archive their posts, and will the archive hold up later?
Preservation of at-risk accounts can often start within a business day of agreeing scope. We capture full threads with URLs, post IDs and UTC timestamps, hash every file and keep a chain-of-custody log, so anyone can later confirm nothing changed. Admissibility is for the court to decide, but documented, repeatable captures give counsel a much stronger position than screenshots.
My ex keeps posting about me from what I think is a fake X account — can you find out who runs it and give me their current address?
No. We do not take cases about former partners, and we never provide the home address of a private individual. If the posts are harassing or threatening you, please report them to the police and to X, and contact a local support service; a lawyer can advise on a protective order. We decline any request that could help one person locate or monitor another.
Our comms team wants every post from a hostile account over the last five years — is that realistic, and does it change how long the X investigation takes?
It is possible, but rarely the best scope. We collect what answers the question, typically the relevant threads, their spread and the accounts involved. X's developer pricing is now pay-per-use, with post reads charged per resource returned, so bulk historical collection has a real cost and time impact. Focused cases take from 10 business days; large campaign reviews take up to about a month.
Sources and Notes
- X Help Center: Impersonation and deceptive identities policy
- X Developer Platform: X API pricing (pay-per-use)
- OHCHR and UC Berkeley: Berkeley Protocol on Digital Open Source Investigations
Sources checked 9 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.