Ultimate Guide to China OSINT: Gathering Intelligence Online

May 31, 2025 |

If you're doing serious OSINT on China, you need to understand that traditional tools and methods won't work. Platforms like Google, Facebook, and Twitter don't operate in China. Instead, local alternatives — each with its own structure and data — offer huge OSINT opportunities. To succeed at country-specific intelligence gathering, you have to know the domestic platforms.

Whether you're doing corporate investigations, cyber threat intelligence, due diligence, or journalistic research, understanding China's online space is more critical than ever — especially given the geopolitical events of May 2025 across Taiwan–China, China–US, and the growing tensions on the cyber front. This post walks you through what data can be extracted from China's key platforms, along with EPCYBER's own insights.

Reverse-searching target data across China's domestic platforms.

Key Chinese social media and OSINT platforms

China's internet is separate from the Western web. Here's a breakdown of the main platforms and how OSINT analysts use them.

QQ and QQ Mail

A messaging and email service — think of it as China's answer to Telegram. It's an older platform, still popular in second-tier cities and among certain age groups. Analysts use it to connect email trails to other services, especially in credential investigations. What you can extract:

qq.com emails (linked to WeChat, forums, and more)
QQ group info (leaks, underground networks)
Account activity patterns

The challenge: QQ is heavily restricted. Where there was once an international version, today you often can't even install the QQ APK on a foreign device — it recognizes the device as outside China, and a VPN won't help. Even if you install it, registration is hard, because the app is heavily monitored and foreign numbers are not accepted. Learn more about our offerings →

WeChat (微信)

Messaging plus social media, and central to profile discovery, contact tracing, and business-link analysis. Use it to trace connections between businesses and individuals, especially in cross-border finance or scam investigations. What you can extract:

WeChat IDs (often shared on other platforms)
Phone numbers and emails from business accounts
Group membership, where visible
Behavioral patterns via Moments (public posts)

Weibo (微博)

Microblogging, similar to Twitter — ideal for tracking narratives, influence behavior, and crisis-communication trends. What you can extract:

Usernames tied to email or phone numbers
Posts mentioning locations and personal details
Business profiles with contact info
Reverse-image trails from profile pictures

We've demonstrated how to convert any image hosted on Weibo's servers into a user ID (UID) — effectively identifying who posted it. Our SOCMINT section goes deeper into full QQ and WeChat OSINT, from bypassing restrictions and creating accounts to gaining access and running effective investigations.

Xiaohongshu (Little Red Book, 小红书)

Lifestyle and product reviews — a blend of Instagram and Pinterest. Often used by businesses for marketing, which makes it great for brand- or product-linked investigations. What you can extract:

WeChat IDs and emails from bios
Trends and network connections
Visual content useful for reverse searches

EPCYBER has conducted interesting research into this app, which allegedly leaks users' phone numbers.

Zhihu (知乎)

A Q&A forum like Quora, useful for professional research, identifying expert affiliations, and niche communities. It's especially good for finding professionals discussing sensitive or insider topics. What you can extract:

Email addresses in bios and replies
Company and job info
Tech-stack mentions and user expertise
Links to personal blogs or sites

Douyin (抖音)

Short video — the original TikTok. Useful for content tracking, influencer monitoring, and identifying location, behavior, and relationships through casual or promotional content. What you can extract:

Public video posts
Linked social accounts
Facial-recognition targets via stills

In the course we also cover navigating language barriers and cultural context in OSINT — part of SOCMINT, DouYin, and communication forms.

Baidu Tieba (贴吧)

Forum-based communities, like Reddit — good for community monitoring, sentiment tracking, and niche topics. Especially useful for tracking unfiltered public opinion or early-stage issues. What you can extract:

Threads on controversial or underground topics
Username trails across bars (forums)
Archived deleted content via search cache

Chinese search engines and business tools

Baidu (百度)

The main search engine in China — use it for dorking Chinese websites. Example queries:

site:weibo.com "@qq.com"
filetype:xls OR filetype:csv "contacts" site:qcc.com

We've done interesting research on Baidu indexing files and documents marked confidential, using a manual "elimination method" to identify subdomains and services.

QCC.com (企查查) and Tianyancha.com (天眼查)

Business-registration directories, central to corporate OSINT, ownership tracking, and due diligence. Use them to tie individuals to companies, even shell firms. What you can extract:

Legal representative and shareholders
Email and phone numbers
Registered addresses
Court cases and financial info

We've shown — live — how to bypass QCC.com and Tianyancha, which often block access using DPI or geo-restrictions that make simple VPNs useless. In the course we teach at least four unique access methods (with more in development), several adapted directly from advanced penetration-testing practices.

Baidu Maps and Dianping (大众点评)

Maps and review platforms, useful for location intel and business validation — good for confirming fake businesses or validating operations. What you can extract:

Phone numbers
Physical addresses
Business hours and photos

How to extract emails, phones, and usernames

Chinese emails

Look for @qq.com, @163.com, @126.com, @sina.com, @sohu.com, and @aliyun.com — often tied to WeChat or business accounts. Dorking works well, for example: "@qq.com" site:zhihu.com

Phone numbers

All begin with +86. Mobile numbers often start with 13x, 15x, 17x, 18x, or 19x (for example +86 138-xxxx-xxxx). Landlines start with a city code — 010 (Beijing), 021 (Shanghai), 0755 (Shenzhen). Look for them in bios, contact pages, and database dumps.

Usernames

Track common usernames across Weibo, Zhihu, RedNote, and Tieba, using reverse-username lookup tools or search engines.

Tools and tactics

Use Chinese dorking with Baidu and Sogou
Try reverse image search in Chinese engines
Use scrapers carefully — platforms block bots
Use tools like Maltego or OSINT Industries to visualize and map relationships

Why this matters now

Doing OSINT without including China is like solving a puzzle with half the pieces. From company ownership to cyber threat actors, much of the world's activity touches China's digital space. If you know where to look and how to search, you can gather real, actionable intelligence from these platforms. It takes a different mindset, different tools, and a new set of techniques — but the payoff is maximum coverage and visibility into this closed ecosystem.

Chinese cloud storage in particular is a goldmine for those who understand how misconfigurations happen and how data is structured. Sometimes a simple tweak in a URL, or a glance at a bucket's naming convention, can unlock entire collections of files that were never meant to be public. The key isn't just knowing where to search — it's knowing what others overlook.

Ready to learn more advanced techniques? Read the full course information across our training programs.