Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.
TL;DR
- For Twitter OSINT in 2026, the big change is that free, bulk access to X data is over. Since February 2026 the X API is pay-per-use by default, at $0.005 per post read, with no free tier for new developers.
- The logged-in search bar still does most of the work: from:, since:, until:, min_faves: and filter:links all work in 2026, and post IDs encode their own timestamps.
- Handles change; the numeric account ID does not. Record the ID for every account you cite, and check the "About this account" panel for join date, username changes and the country or region X assigns.
- Archive before you publish or report. The Wayback Machine and archive.today both capture X posts, with different failure modes.
- UserSearch helps you pivot from a handle to other platforms and keep the whole enquiry in one auditable Case.
The Old X Research Toolkit Has Gone
Twitter OSINT in 2026 means researching public posts, replies, media and account metadata on X with the tools that still work: logged-in search operators, permanent account and post IDs, public archives and the paid API. If you learned Twitter research before 2023, most of your toolkit has broken. The free API that powered academic dashboards went first. Third-party front ends and command-line collectors followed as X closed the unauthenticated routes they depended on. Search now needs a logged-in account. Posts can be edited, accounts rename themselves overnight, and the viral clip you are verifying may have been deleted by the time your editor asks for the link.
And yet X still matters. Breaking news, official statements, influence operations and brand abuse all still surface there first, often hours before anywhere else. The question for journalists and threat intelligence teams in 2026 is not whether to research X, but how to do it with the tools that still work, at a cost you can justify, and with records that stand up afterwards.
This guide covers what we use: the search operators that survived, the permanent identifiers that outlast a handle change, the archives that preserve posts, the paid API for when you need scale, and Community Notes as a verification input. The method is on-demand research into posts, organisations and networks of accounts, anchored to a specific question.
What Does X (Twitter) OSINT Cover in 2026?
X (the platform formerly called Twitter, renamed in 2023; the platform's history is well documented) is a public broadcast network. X OSINT is the practice of answering a research question from its public material: posts, replies, quotes, media, lists and account metadata. Typical questions include:
- When did this claim or video first appear, and who posted it first?
- Is this account the same one that posted under a different name last year?
- Is a group of accounts behaving in a coordinated way, and what do their metadata signals say about where they operate from?
- Has an official statement been edited or deleted since it was posted?
The key concept is the difference between presentation (display name, handle, bio, avatar) and identifiers (the numeric account ID and post IDs). Presentation changes whenever the owner likes. Identifiers do not.
Why Does X Still Matter for Newsrooms and Security Teams?
In November 2025 X rolled out an "About this account" panel. Within days, researchers and reporters used it to show that several large US political accounts were run from elsewhere. CBS News reported on accounts with hundreds of thousands of followers posting US partisan content while X's panel placed them in Eastern Europe, South Asia or Africa, including one that described itself as "independent" and gave a Florida location in its bio. The same report notes the caveats: people use VPNs, some accounts carry a warning that the location may be inaccurate, and account holders can choose to show a region instead of a country. It was a sharp reminder that metadata can overturn a narrative, and also that metadata needs corroboration.
X also remains a news source that audiences take seriously. The Reuters Institute's Digital News Report 2026 found that X and YouTube are the only two networks where more than half of users say the platform is a useful way to get news, even as X's news use fell among younger audiences and in the US. When a claim spreads on X, your readers or stakeholders will see it. Verifying it is part of the job. Our tools for journalism teams are designed around that verification work.
The Manual Method: Search Operators, IDs and Archives
Everything below uses a logged-in X account in a browser, plus a terminal for two small calculations. Use a work account that clearly represents you or your organisation, and keep a log of what you searched and when.
The advanced search operators that still work
X's visual form at x.com/search-advanced covers the basics, but typing operators directly is faster and provides filters the form does not. The most thorough community reference is Igor Brigadir's twitter-advanced-search repository. It was last updated in early 2024, so we cross-checked each operator below against an April 2026 operator review and confirmed they are still listed as working. X changes search without notice, so test critical queries on the day.
from:example_handle since:2026-03-01 until:2026-03-08from: limits results to posts by one handle. since: is inclusive and until: is exclusive, both in YYYY-MM-DD format. This query returns posts from 1 March up to the end of 7 March. The dates are UTC unless you use the extended form below.
"bridge collapse" since:2026-03-04_06:00:00_UTC until:2026-03-04_12:00:00_UTCThe extended form narrows to a six-hour window. This is how you find the earliest posts about a breaking event instead of the most popular ones. Switch to the Latest tab; the Top tab reorders by engagement and will bury the timeline you are trying to build.
"bridge collapse" min_faves:500 -filter:repliesmin_faves: sets a minimum like count, which surfaces the posts that actually spread. There is no form field for it, so type it. -filter:replies removes replies. min_retweets: and min_replies: work the same way.
from:example_org filter:links -filter:mediafilter:links keeps posts containing URLs, which includes media. Adding -filter:media leaves only posts with outbound links, which is useful for mapping which sites an organisation's account pushes traffic to.
url:example.com lang:enurl: finds posts linking to a domain, including many shortened links once expanded. lang: filters by the two-letter language code X assigns, which is sometimes wrong for short posts.
conversation_id:1844000000000000000 -from:example_handleconversation_id: returns the replies in a thread, direct and indirect, given the ID of the first post. Excluding the original author shows you how others responded, which is often where the first debunk or the first eyewitness correction appears.
Two points of friction. First, time operators need something else in the query to work; a bare since: returns nothing useful. Second, X caps a query at roughly 22 to 23 operators, and long queries sometimes fail silently. Split them.
Post IDs carry their own timestamps
X post IDs are Snowflake IDs: 64-bit numbers whose upper bits encode the creation time in milliseconds since X's epoch (1288834974657). You can decode them without any API:
python3 -c "import datetime as d; i=1844000000000000000; print(d.datetime.fromtimestamp(((i>>22)+1288834974657)/1000, d.timezone.utc))"i>>22 shifts off the machine and sequence bits, leaving the timestamp. Adding the epoch gives Unix milliseconds, and the result prints in UTC. This matters when a screenshot shows a local time, the displayed date has been edited in an image, or a post has been deleted and all you have is a URL. The ID in the URL tells you when it was created. Newer numeric account IDs are Snowflakes too, so the same maths gives an approximate account creation time; older, shorter account IDs are sequential and do not decode this way.
Record the account ID, not just the handle
A handle is a label that the owner can change, and after a change an old handle can be claimed by a different account. Links built on the old handle stop pointing where they used to. The numeric account ID stays with the account for life. If you cite @example_handle in a report without its ID, a reader who checks next year may land on a different account entirely.
There is no official, free lookup for the ID any more. In practice researchers read it from the page's own network traffic (open your browser's developer tools, reload the account page, and search the responses for rest_id), or from the URL of the account's header image, which contains the numeric ID. If you have API access, one call returns it:
curl -s "https://api.x.com/2/users/by/username/example_handle?user.fields=created_at" \
-H "Authorization: Bearer $X_BEARER_TOKEN"This needs a paid developer account and a bearer token in the X_BEARER_TOKEN environment variable. Under the current pay-per-use pricing a user lookup costs $0.010, so a few dozen checks cost pennies. Then open the account's "About this account" panel by tapping the join date. It shows the join date, the number of username changes, how the app was installed and the country or region X assigns. A high username-change count on an account presenting as a long-standing local news outlet is exactly the kind of signal worth recording, and worth corroborating.
Archive posts before they change
Posts get deleted, edited or restricted. Archive anything you intend to cite, at the moment you find it.
https://web.archive.org/save/https://x.com/example_handle/status/1844000000000000000Visiting this form of URL asks the Wayback Machine to capture the post now. The weakness: X is a heavily scripted site, and some captures show a login prompt or an empty frame instead of the post. Open the capture and check that the text and media actually rendered.
https://web.archive.org/web/*/twitter.com/example_handle/status/*The wildcard search lists earlier captures of an account's posts. Search both twitter.com and x.com forms, because older captures sit under the old domain.
archive.today (archive.ph) often renders X posts more faithfully, and it keeps a static snapshot and a screenshot. Expect CAPTCHA challenges and occasional slow queues. For anything that may end up in a legal or regulatory file, a local capture with hashes and timestamps is stronger than a public archive link, and ideally you want both.
When you need scale: the paid API
Operators and a browser are enough for a single story. If you need thousands of posts, the official API is the only route that stays within X's rules. The search documentation describes two endpoints: recent search, covering the last seven days, and full-archive search back to 2006, which is available on pay-per-use and Enterprise plans. At $0.005 per post read, 20,000 posts cost about $100. Pay-per-use plans are capped at 3 million post reads per billing month, and duplicate reads of the same resource within a 24-hour UTC window are not charged twice. Budget before you run anything, and set a spending limit in the developer console.
Where Does UserSearch Fit Into X Research?
Once you have a handle and an ID, the next questions usually leave X. Does the same handle exist on Telegram, Reddit or GitHub? Does the website the account links to share ownership with other sites? Is the image in the viral post older than the event? Answering those by hand means a dozen tabs, a dozen sets of notes and no single record of what you checked.
UserSearch brings those pivots into one place. Username Intelligence checks a handle across many platforms, and our guide to reverse username OSINT explains how to read the results without jumping to conclusions. Domain Intelligence covers ownership, history and favicon links for the sites an account promotes. The Picture Search type runs reverse image search, geolocation and synthetic-image checks on stills from a post. OneScan runs one input across the sources you select and merges results with source attribution, showing the Credit cost before you run.
For the record-keeping, run the enquiry in a Case with Forensic Mode so the search history and bookmarks are stored, or use Private mode when history should not be kept. Our free Forensic Capture extension captures the X post as a full page with SHA-256 fingerprints and two independent timestamps (RFC 3161 and OpenTimestamps), and it runs locally in your browser. All results are leads to corroborate; coverage and freshness depend on the third-party source.
Advanced Verification Patterns for X
Scenario: verifying a viral flood video
Context. A regional newsroom sees a dramatic flood video spreading fast, first attributed to @example_handle, captioned as filmed "this morning" in a fictional town the paper covers.
Actions. The producer searches the caption's key phrase with a six-hour since: and until: window on the Latest tab and finds an earlier post of the same clip from a different account. Decoding both post IDs confirms the other post came 40 minutes earlier. The "About this account" panel for @example_handle shows five username changes and a join date two months ago. A keyframe from the video, run through a reverse image search, matches a news report from a flood in another country three years earlier. The producer archives both posts and captures them locally.
Outcome. The newsroom does not run the video as local footage. It publishes a short explainer showing the original source and the dates, with archive links, and flags the post for a Community Note.
Scenario: mapping a brand-abuse network for a security team
Context. A fictional software company, Example Systems, finds X accounts using its logo to promote a "token giveaway" that sends people to example.org, a site it does not own.
Actions. The CTI analyst runs url:example.org and finds 30 accounts posting the link. She records each account ID, join date and username-change count. Twelve accounts were created within the same week and several renamed themselves from unrelated names in the last month. Domain research on example.org shows it was registered days before the first post and shares hosting with two other lookalike domains.
Outcome. The security team files platform reports with IDs rather than handles, so renames do not break them, sends a takedown request to the registrar with archived evidence, and publishes a customer notice on its own site. The Case holds the whole record for the next time the scam returns under new names.
Using Community Notes as a verification input
Community Notes lets contributors add context to posts. A note is shown only when raters who usually disagree with each other both find it helpful, which makes displayed notes a useful but lagging signal. The scoring code is open source in the Community Notes repository, which also holds a template for X's AI Note Writer API. For research, the more valuable resource is the public data: X publishes daily downloads of all notes, including ones never shown, their ratings and their status history. Searching the notes file for a post ID tells you whether contributors raised concerns that never reached the threshold. Treat notes as leads, not verdicts: they are crowd-written and can be wrong.
Checking whether an official statement changed
X allows edits within a short window, and organisations delete posts. For statements that matter, compare the live post, the Wayback Machine captures and your own local capture. The post ID never changes on an edit, but edits create a new version, and the edit history link on the post shows earlier versions. When a statement disappears, the ID and your archive are what let you prove it existed.
Working Within X's Terms and the Law
X's Terms of Service say you may not access or search the service by any means other than its published interfaces, and state that automated crawling or copying in any form without X's prior written consent is prohibited. A revised version takes effect on 9 October 2026, so re-read it. In practice that means the search bar, the official API and manual archiving are the permitted routes. Leave unofficial collection tools out of your workflow.
Data protection law applies to public posts as much as private ones. Under the UK GDPR and EU GDPR, record your lawful basis (public interest journalism and legitimate interests are the usual ones), collect only the posts and metadata that answer your question, and set a retention period. A few habits keep research proportionate:
- Focus on posts, organisations and networks of accounts, not on individuals' personal lives.
- Treat the "About this account" country or region as a signal to corroborate, never as proof of who runs an account or where a person is.
- When you contact a poster to verify footage, do so openly and ask permission to use it.
- Redact handles of private individuals in published work unless naming them serves the public interest.
Frequently Asked Questions About X (Twitter) OSINT in 2026
Does Twitter OSINT still work in 2026?
Twitter OSINT still works in 2026, but the toolkit has changed. The free API and most third-party collectors are gone, and search needs a logged-in account. Search bar operators, numeric account IDs, timestamps encoded in post IDs, the Wayback Machine and archive.today, and the paid pay-per-use API remain the main routes for research on X.
How much does the X API cost in 2026?
Since February 2026 the X API is pay-per-use by default, with no free tier for new developers. A post read costs $0.005, so 20,000 posts cost about $100, and a user lookup costs $0.010. Recent search covers the last seven days, while full-archive search back to 2006 is available on pay-per-use and Enterprise plans.
Which X search operators still work for Twitter OSINT?
The X search operators from:, since:, until:, min_faves:, filter:links, url:, lang: and conversation_id: all still work in 2026 in a logged-in browser. The since: operator is inclusive and until: is exclusive, and an extended form narrows searches to hours in UTC. X caps a query at roughly 22 to 23 operators, and long queries sometimes fail silently.
How do you find when an X post was created?
X post IDs are Snowflake IDs whose upper bits encode the creation time in milliseconds since X's epoch. Shifting the ID right by 22 bits and adding the epoch value 1288834974657 gives Unix milliseconds, which convert to a UTC date. This works without any API, even when a post has been deleted and only the URL survives.
Why should researchers record an X account ID instead of the handle?
A handle is a label the owner can change, and an old handle can later be claimed by a different account, so links built on it stop pointing where they used to. The numeric account ID stays with the account for life. Citing the ID alongside the handle means a reader who checks a report later reaches the same account.
How do you archive a post on X?
To archive an X post, submit its URL to the Wayback Machine's save form and open the capture to confirm the text and media rendered, since some captures show only a login prompt. Archive.today often renders X posts more faithfully. For legal or regulatory files, a local capture with hashes and timestamps is stronger, ideally alongside a public archive link.
From Viral Post to Verified Record with UserSearch
X research in 2026 rewards discipline more than tooling. Type your operators, decode your IDs, record account IDs alongside handles and archive before you cite. Pay for the API only when the question needs scale, and treat every metadata signal, including Community Notes and the country label, as something to corroborate.
Stop guessing. Start researching with UserSearch. One UserSearch account gives you 18 Search types and access to 100+ third-party data sources, so the handle you found on X can be checked against other platforms, domains and images in one place. OneScan merges results with source attribution, Cases in Forensic Mode keep a reviewable history, and SargeBot can help build entity searches and draft a PDF report for you to verify. For more on platform research, see the social media research knowledge base, then start your next verification with UserSearch.