chat-apps-osint: P2P Metadata and IP Exposure Analysis in Messenger VoIP Calls

Open-source security tool 'chat-apps-osint', developed by 0x6rss, has gained attention across the cybersecurity community for demonstrating the peer-to-peer (P2P) metadata exposure mechanisms inherent in voice calls on major messaging apps, including WhatsApp, Signal, and Telegram. Highlighted on September 23, 2026, by security researcher Nix0n (@UnTalNixon_exe), the utility provides a hands-on technical breakdown of how answering a VoIP call can expose network-level reconnaissance vectors even when conversation payloads are protected by end-to-end encryption (E2EE).

Image source: @UnTalNixon_exe on X

While the contents of text messages and voice streams are cryptographically secured by end-to-end encryption protocols, the underlying network transport layer responsible for establishing low-latency voice connections behaves differently. To minimize audio latency and packet round-trip time, messaging applications often prioritize direct peer-to-peer connections between callers. By observing initial connection handshakes and packet headers during an active call, chat-apps-osint illustrates how a calling party can gather technical fingerprints from the recipient endpoint without breaking cryptographic defenses.

P2P VoIP Handshakes and the Mechanics of Passive Reconnaissance

The core mechanism analyzed by chat-apps-osint lies in the standard call establishment architecture used by modern mobile messaging platforms.

To deliver real-time voice conversations without noticeable lag, mobile messaging apps attempt to establish direct peer-to-peer (P2P) connections between the caller and the recipient. Routing media packets directly between two user endpoints bypasses central server relays to achieve optimal latency, but it inherently requires both devices to exchange network addresses. Once an incoming call is accepted by the recipient, the direct P2P VoIP session is established, allowing network-level telemetry to be captured directly from standard connection handshakes.

• External Public IP Discovery: As soon as the recipient answers the incoming call, a direct network session opens, exposing the recipient's public IP address in the exchanged packet headers.
• Geolocalization Estimation: Using the exposed IP address, an investigator can resolve the approximate geographical location and IP routing information of the target.
• Network Interface Profiling: The tool identifies whether the recipient is connected via a local Wi-Fi network or a cellular mobile data connection.

Importantly, this technique relies entirely on passive reconnaissance. It does not exploit a software memory corruption bug or deploy malware on the target device, but instead passively captures and inspects the standard connection metadata generated by legitimate VoIP handshakes.

Exposed Device Metadata, Operating Systems, and Multi-Device Fingerprints

Beyond raw IP address capture, chat-apps-osint parses additional metadata embedded within active call session exchanges to build a profile of the recipient's device environment.

The metadata collected during an active voice session includes detailed operating system information for the target device (distinguishing Android from iPhone), as well as the count and technical details of secondary devices linked to the target user account.

• No Call Audio Interception: In follow-up technical discussions, researcher Nix0n (@UnTalNixon_exe) explicitly clarified that the tool does not record, decrypt, or eavesdrop on voice conversations. The audio payload remains encrypted.
• Separation of E2EE and Metadata: While end-to-end encryption shields the actual audio packets from unauthorized parties, the transport-layer telemetry required to route the call—identifying who connects, when, and from what device architecture—remains outside the encryption envelope.
• VoIP Surface vs. Text Chats: In standard text messaging, central server relays typically terminate connections, preventing peer IP leakage. Direct VoIP calling introduces a distinct attack surface by default because the architecture prioritizes performance over metadata isolation.

Operational Constraints and Defense via Call Relaying

Understanding chat-apps-osint requires recognizing its operational prerequisites and the corresponding mitigations available within messaging clients.

Crucially, the target must actively answer the incoming call. If a call rings without being picked up or is rejected by the recipient, a direct P2P media session is never completed, preventing metadata harvesting. The tool does not function as a zero-click exploit or remote code execution (RCE) vulnerability.

To defend against peer IP and transport metadata leakage, users can utilize in-app privacy settings that enforce server-relayed calling rather than direct peer-to-peer sessions. While routing calls through intermediate relay servers may introduce a minor latency penalty due to additional network hops, it presents the relay server's IP address to the caller rather than the recipient's personal device IP.

Finally, unconsented collection of IP addresses and device identifiers may constitute unauthorized interception or privacy violations under applicable laws. As such, research into call metadata exposure should be restricted to authorized security testing and defensive privacy evaluation.

Sources

• 0x6rss GitHub Repository: chat-apps-osint Repository
• Nix0n (@UnTalNixon_exe) on X: September 23, 2026 Analysis and Demonstration Post
• WhatsApp Official Blog: WhatsApp Blog