WEIR
Get a key
Theme

Twitter OSINT: Tools and Techniques to Verify Posts (2026)

Twitter OSINT the way fact-checkers work: date a post from its id, find the original, check the account, edits and archives, and the lines to never cross.


Published · Updated · 7 min read

Cover image: Verify the post, not the person

Twitter OSINT means checking public posts and accounts on X: when a post went up, where it started, and whether the account is genuine.

This guide is for journalists, researchers and anyone who checks X (Twitter) posts before sharing them. You get five Twitter OSINT techniques, a free tool for each, and a real case. We run Weir, the API in the examples.

Paste any post's id into this and you'll see when it went up:

from datetime import datetime, timezone

post_id = 298246571718483968  # the digits after /status/ in a post's link
ms = (post_id >> 22) + 1288834974657
print(datetime.fromtimestamp(ms / 1000, timezone.utc))

The checks borrow three questions from Bellingcat's verification guide: is it original, who posted it, and when?

  1. Date the postDecode the id. No account needed.
  2. Find the originalfrom:, dates, quotes and replies.
  3. Check the accountJoined, based in, renames, bot signals.
  4. Read the edit historyEvery version of an edited post.
  5. Search the archivesSaved copies on the Wayback Machine.

Step 1: Date a post from its id

Every X post id tells you when the post was made. X's developer docs say each id carries a timestamp, a worker number and a sequence number.

Twitter's open-source Snowflake code shows you the math. Shift the id right by 22 bits. Then add X's epoch, which falls on 4 November 2010.

We tried it on a famous post: Oreo's "Power out? No problem." from the 2013 Super Bowl blackout.

01:48:18 UTCthe time in the post's id, 4 February 2013
8:48 p.m.when Digiday says Oreo posted it
5 hoursthe gap between UTC and US Eastern time in winter

The two agree once you mind the time zone. Even the copy embedded in Digiday's article reads 4 February, the UTC date, so check the zone before you quote one.

This works for posts from November 2010 on. An older id decodes to the epoch itself, 4 November 2010, so date that post with search instead.

Step 2: Find the original of a viral post

Search helps you find the first copy. On X, from: keeps one account's posts, and since: and until: set a window of UTC days. To find Oreo's original, type this into X's search box and pick Latest:

from:Oreo power since:2013-02-03 until:2013-02-05

We ran the same search through Weir's API on 22 October 2026, with exact times. It returned one post, for 2 credits:

{
  "id": "298246571718483968",
  "text": "Power out? No problem. http://t.co/dnQ7pOgC",
  "createdAt": "2013-02-04T01:48:18.000Z",
  "author": { "username": "Oreo", "verified": true },
  "retweetCount": 11453
}

Its createdAt matches the id to the second.

Counts drift, though: Digiday reported over 15,000 retweets, so date every count you quote.

Don't know who posted first? Work outward from your copy:

  • Search the exact words in quotes, then move until: earlier until only the first copies remain. Our guide to searching tweets by date shows how.
  • Follow the quote trail with quoted_tweet_id:, as our guide to seeing quote tweets explains.
  • Read the replies with conversation_id:, where others may point you to an earlier source.
  • Reverse-search the images. Bellingcat says this "can quickly help uncover previous uses of an image online".

Step 3: Check whether an account is what it claims

A checkmark alone tells you little. In November 2022, a fake account calling itself Eli Lilly and Company posted that "insulin is free now". Gizmodo reported its blue check came from Twitter's $8 monthly subscription.

Tap the Joined date on a profile to open "About this account". TechCrunch's launch report lists what you'll see: where it's based, how it connects, and how often its username changed.

We read @Oreo's details through Weir on 22 October 2026. The call cost 3 credits:

{
  "username": "Oreo",
  "createdAt": "2010-03-24T19:56:32.000Z",
  "aboutProfile": {
    "accountBasedIn": "United States",
    "locationAccurate": true,
    "usernameChanges": { "count": 0 }
  },
  "verificationInfo": { "verifiedSince": "2011-11-18T23:43:36.736Z" }
}

Here's what each part tells you:

  • Joined March 2010. If a brand claims a long history, you should see an old account.
  • Based in the United States, marked accurate. When X suspects a proxy, it warns "This data may not be accurate", NBC News reported. See what "account based in" means.
  • No username changes. If you spot a recent rename, see Twitter username history.
  • Verified since November 2011, years before Twitter sold checkmarks.

If the account posts like a machine, count the bot signals. DFRLab's #BotSpot guide calls 72 posts a day suspicious. Our bot checker walks you through seven signals.

Step 4: Check the edit history

A screenshot that doesn't match the live post may show you an earlier version, not a fake.

X's API docs allow 5 edits at most, and each edit creates a new post id. Weir's edits endpoint returns every version, newest first. An empty list means no edits.

curl https://api.weirapp.io/v1/x/posts/1666263252685451264/edits \
  --header "Authorization: Bearer $WEIR_API_KEY"

That id is an edited post from @Subscriptions, which our tweet edit history guide walks you through version by version.

Step 5: Look for archived copies

Posts you need can vanish. When we tried to re-read Eli Lilly's apology on 22 October 2026, X reported its account, @LillyPad, as protected. The apology no longer loads for the public.

The Wayback Machine may still hold a copy:

  • Look it up. Paste the post's link into web.archive.org. The Internet Archive's help center says blue dots mark successful captures.
  • Compare. Check the saved words and time against the screenshot you were sent.
  • Save your own. "Save Page Now" stores one page at a time, but the help page warns JavaScript pages are often hard to archive. Keep a dated screenshot too.

Twitter OSINT tools for each check

Every check has a free route. An API helps you when you check many posts or accounts at once.

Check Free tool By API (Weir)
Date a post Tweet ID to Date converter Decode the id yourself
Find the original X search: from:, since:, until: POST /v1/x/search
Quotes, replies quoted_tweet_id:, conversation_id: /quotes, /replies
Account details About this account GET /users/{user}/about
Edits The post's edit history GET /posts/{id}/edits
Archives Wayback Machine None
Images Reverse image search None

Start free; reach for an API when your story has hundreds of posts.

What Twitter OSINT must never do

Verification checks content and public-interest accounts. It never targets a person.

The line we hold, in this guide and in Weir:

  • No unmasking. Don't try to learn who runs an anonymous account.
  • Never dox. Someone's home, workplace, family and contacts are off-limits.
  • Leave private people alone. If you watch a private individual's posts or movements, that's tracking.
  • Skip the workarounds. Nothing here helps you get around X's limits, rules or terms.

Weir's acceptable use policy says the same. You may not use Weir to:

  • "track, monitor, or build profiles of specific individuals without a lawful basis";
  • "link an online identity to a real-world one, to expose or target them".

Newsrooms hold this line too. Bellingcat's guide left one account unnamed "so as not to draw unnecessary attention to the user".

X's terms and rules also cover what you collect and share. This isn't legal advice.

When not to use Weir

  • You check one post by hand. The free tools cost you nothing.
  • The post is deleted or the account protected. Weir only gives you public data.
  • Posting or replying is the job. Weir is read-only.
  • A contract with X is required. Weir isn't licensed by X, so access can change.

FAQ

What is Twitter OSINT?

It's open-source intelligence work on X: checking public posts and accounts with tools anyone can use. Fact-checkers use it to date a post, find where it started, and test an account before they report on it.

Which X OSINT tools are free?

X's search and its "About this account" screen, our Tweet ID to Date converter, the Wayback Machine and any reverse image search. You don't need Weir for any of them, only for checks in bulk.

Can you see deleted tweets?

Not on X itself, and Weir gives you only what is public now. Check the Wayback Machine for a saved copy, and look for quote posts or screenshots made before the post went.

Sources

All checked on 22 October 2026:

Keep reading