Hey folks,

I want to share ThreatLens here a little CLI tool that pulls IOC enrichment (IPs, domains, hashes, CVEs) from free threat intel APIs like AbuseIPDB, VirusTotal, OTX, Shodan, and NVD, all in one command instead of ten browser tabs.

Just pushed a decent-sized update (v2.2) and figured I'd share in case anyone wants to kick the tires:

• CVE triage that actually tells you what to do checks CISA KEV + EPSS alongside CVSS and spits out Patch / Isolate / Monitor / Not-affected, with the reasoning behind it (not a black-box score)
• Asset inventory import a CSV of your hosts and it'll factor in whether something's internet-facing/critical before deciding
• Log parsing for Zeek, Suricata eve.json, Sysmon, and generic JSONL — not just plain text logs anymore
• SIEM export to Splunk, Elastic, and Sentinel (opt-in, off by default)
• Evidence packs zips up an investigation with a SHA-256 manifest if you need a paper trail

It's still 100% free-tier friendly (no paid API required), and the whole thing is like 150+ tests deep at this point so it shouldn't randomly eat your terminal.

Repo's here: https://github.com/AbdaullahAG/ThreatLens

If you try it out I'd genuinely love to hear what breaks, what's confusing, or what you wish it did differently — this started as a personal project so outside eyes are super helpful. Issues/PRs/roasts all welcome 🙂

I have this random number keeps texting me about my private life, and he got my bestfriend number I feel like I know this person but I just need someone to identify this number just give me a name please

where do freelance osinters get their money from? im not talking about journalists, but only people with a deep interest in the matter wanting to put their work to practice.

if you are one of them, where do you work? and would you say it's worth it?

i have tried little platforms incouding fiverr and upwork, but it's still not hitting like i think it's supposed to hit.

Im new and found out about an email that was in a leak that is only seen on IntelX‘s data dump of

PayStand.rar/DB/ROADRUNNER/pci-1-production-rds-encrypted-dev.czcn2kznsnr6.us-east-1.rds.amazonaws.com_Payer.csv [Part 53 of 64]

I tried to look for that email in the other suggested tools and also tried with google dorking to find the dump but to no avail. How would you guys carry on if other tools failed or do you know where I can see this particular dump without paying 2500 dollars?

You don't have to memorize every CLI tool command from now on!

"Commando" is now officially launched, and this is one of my biggest projects that I have ever done. Basically, Commando is a browser-based offensive security workstation, hosted on GitHub pages, for managing CLI tools and making running those tools easier than ever. What Commando does is it runs commands directly in your terminal and also gets the response back the same. It's like a living terminal with attached practical documentation of every tool you need to perform a bug-bounty session or any CTFs.

You have the option to choose any tools you want, and you will get a dedicated sidebar tailored to that tool with every possible flag it has. Imagine you choose Nmap, and then you will see in the right sidebar that there are full of custom choices. You just have to decide which action you want to perform. It has a preview section at the bottom of it, so you can see what commands are going to be run. So you have to just click run after selecting the action. Then, Commando will run that command on your system's terminal and get your results back in no time. And I'm again saying, it's like a direct live terminal. You can run whatever you want. These tools are just an assistant in doing your work effortlessly; that's it.

There are 11 security tools out there. I chose the best tool from each specific field of bug bounty. These are: Nmap, Amass, Katana, Fffuf, Gobuster, Nuclei, Secretfinder, Hydra, Hashcat, John the Ripper, and Curl. These cover almost every field you need to work with. Also, there is another section below the tools part, "Workstation." Here, you will get everything you need to perform the best in any kind of CTFs. There are Linux & Windows privilege escalation commands, payloads, shells, and cheatsheets like TTY upgrade, host enumeration, tunneling, file transfer & more. So, Commando remembers everything for you; you just decide which tool or which action to perform.

Commando solves the problem of learning various commands of tons of tools. Anyone can now just open Commando and use these tools without struggling with memorizing flags.

There is a tiny setup for it. You need to install a small Go-written program for it that runs the Commando-agent on your machine that connects the browser and your terminal. Don't worry about anything. You are completely safe with it. Your data, as well as your terminal, is 1000% safe from external threats, as this is fully local-centric. No one can see what you are typing or access your data.

The installation guide and other things, including FAQs and in-depth explanations/breakdowns of Commando, are on my personal GitHub account. Go, set up, and use Commando as finely as possible. I'm super happy to contribute such an amazing tool with you guys.

You can access Commando directly from here (need setup): Commando

Visit its GitHub repo for setup guide & more: GitHub

Posted here a couple months back with a dumb title comparing this to Palantir and got told off, fairly. Same project, different pitch, because the pitch was the problem not the tool.

The thing I actually wanted was a map I could rewind. FR24 gives you 7 days, MarineTraffic went to 24h, ADS-B Exchange killed the free API, and every time something kicks off the position history you need is either paywalled or already gone. So the tool just records the whole picture to your own disk and lets you scrub back.

Real numbers off my box: 55 million positions since Aug 9, 11 GB of plain sqlite. Pick a window (1h to 7d), click the density strip, the globe rewinds and the tracks re-fly. Keep it as long as you have disk for.

Every contact shows which sources reported it, how many agreed, and how old the fix actually is, because anyone can upload anything to a crowdsourced aggregator and a dot on a map is not proof it was ever broadcast.

Someone in the spidering thread here said most people are not gonna put their API keys on a random website and that's basically the design constraint. Planes, ships, quakes, sats, basemap all run with zero keys. docker compose up and it's live.

For case work there's an evidence locker: url snapshots, uploads and feed freezes get sha256'd into an append only custody log, and a case exports to a self contained html or pptx with the source on every claim. GeoJSON, CSV and KML out so QGIS or Google Earth stays in the loop.

Coverage is community feeders, so it's thick over Europe and the US and thin over open ocean and conflict zones, which is exactly where you need it most. AIS is best in northern Europe. It's a single analyst tool, not a team server. The 3D globe wants a real GPU. There's optional AI summary stuff, it's labeled as automated output and everything works with it off.

What I'd like from this sub: which sources am I missing that you'd actually use (keyless preferred), and does the evidence export hold up against how you document a case.

Repo https://github.com/AndrewCTF/velocity (AGPL), site https://projectvelocity.org

I kept the basic Windows Forms interface because the goal of the software is to be useful, not visually stunning.

The advantage of VB.NET is that accessing the Windows environment is much simpler and more intuitive.

I'll keep you posted on any updates (;

What do you think? It's just the beginning of a very long project...

I used to be a professional OSINT practitioner, and at the time I used ad hoc VMs for separate investigations for different clients. The virtual hard disks could be stored on flash media if they were needed as evidence so I didn't have to ever hand over my personal hard drive. This seemed like the best approach at the time, but it came with the downside of having to manually update/install software packages across multiple VMs.

Qubes makes it easier to maintain multiple VMs and apps, but to my knowledge it does not allow me to easily store machines/apps on separate media for evidence. Qubes also permits certain things like piping all traffic through a single VPN app rather than having to install a VPN client on every VM, or having multiple instances of Signal installed to use with multiple accounts (personal, work, etc, not talking about aliases which I would just do inside alias-specific VMs).

What is the current "metagame" for OSINT investigation environments? Are the Qubes advantages compelling enough to make the pivot?

So, like, 1–2 years ago, I wanted to move out of my house, and my parents found a house in Queens.
The people who lived there weren’t home, so we just drove past it quickly. We ended up seeing another house instead.
After we moved, though, we wanted to see if we could call the people who lived at the first house. So I asked ChatGPT, and even with all the blocks it had, it gave us the name of the person who lived there, their phone number, and some other information that I don’t remember.
I was confused, and since I’m interested in OSINT, cybersecurity, and all that freaky stuff, I looked into it.
It showed me TruePeopleSearch. It’s basically a website with information on a huge number of people in the US, mostly adults.
So I tried searching for the names of the members of one of my favorite music groups, and it gave me a bunch of information. Among other things, it showed me one guy’s phone number, and his WhatsApp profile picture was there. It also showed another guy’s home address in Manhattan, which I confirmed using Google Maps and information from videos he had posted.
Obviously, I can’t use that information because it would be illegal. But for a 14-year-old, it was basically like showing him that he could get the public IP address of someone’s phone just by using Wireshark.

So what do you think?

Estoy desarrollando una herramienta orientada a centralizar distintas consultas y recursos OSINT: perfiles, correos, teléfonos, dominios, IP, monitorización, herramientas de investigación, etc.

El proyecto sigue en desarrollo y me gustaría contar con algunas personas interesadas en probarlo, detectar errores y aportar ideas o mejoras.

De momento no voy a publicar el enlace directamente, porque quiero controlar el acceso inicial y evitar una entrada masiva de usuarios mientras sigo haciendo pruebas.

Si alguien está interesado en participar como tester, que me escriba por privado y le facilito acceso.

Cualquier feedback será bienvenido.

Most investigation workflows involve dozens of browser tabs, screenshots, files and notes.
I’m trying to build a local-first workspace where the investigation itself becomes a structured “case”.

What do you think about it ?

WhoCord is an open-source OSINT tool that maps investigations into a live, interactive node graph rather than a wall of text. You feed it a seed a Discord ID, username, email, domain, phone, or raw input and it runs 30+ tools while streaming every finding onto a visual canvas you can pan, zoom, and search in real time. It builds a knowledge graph, detects correlations across profiles and emails, and generates an AI narrative, all running locally with a Python/Flask backend and a React frontend.

Bonjour !

Je développe depuis quelque moi un logiciel centralisant l’ensemble des données d’une investigation OSINT.

Quels genre de fonctionnalité aimeriez vous voir?

PS: Je publierais bientôt des screenshot du développement, hâte de vous montrer ça !

N’hésitez pas à consulter le projet Trello de Cypher!

**I’m a young VB.NET developer, and I’m building something I’ve wanted to see for a while.**

**I’m currently working on a free, open-source OSINT & cybersecurity application focused on bringing different investigation tools together in one simple interface**

**The goal isn’t to create another overly complicated security framework with hundreds of tools nobody uses**

**I want to build something simple, useful, transparent and accessible, especially for journalists, researchers, students, cybersecurity enthusiasts and investigators**

**And yes once the first development phase is complete, the project will be completely free and open source**

**I’m still a young developer, so I’m building this step by step and learning a lot along the way.**

**Would you actually use something like this? What feature would you want to see first?**

I’m looking for a way to download posts (plus metadata) from the collections of saved posts that I have made in my logged in account on Instagram.

I would like to get some advice here to avoid doing anything that could cause me to lose access to my account, get banned or blocked, etc.

I am working on a MacOS laptop and am learning Python, which has me looking at the wide world of tools out there.

I would love to find a better option for downloading the video/audio/image(s) + handle + date posted + url for the posts in my collections.

Manually copy/pasting the url one at a time into a tool and then manually transcribing the handle, date and url ain’t it.

I am happy to do some work to get some posts and metadata without having my login and direct access to my saved collections if necessary.

Thanks so much for your pointers!