We are building a highly organized, zero-trust validated, and continuously expanding ecosystem of modern OSINT tools. Our goal is to aggregate everything from widely-adopted frameworks to cutting-edge AI agents and secure communication platforms, creating a centralized hub for researchers, analysts, and developers.
This repository is physically structured using Git submodules, ensuring you always have access to the latest upstream code. We categorize our findings into the following domains:
- Popular & General OSINT: Industry-standard tools, reconnaissance scripts, and broad frameworks.
- Niche & Hidden Gems: Highly specialized, lesser-known utilities built by independent creators.
- AI Agents & Platforms: Next-generation, LLM-driven intelligence gathering, threat mapping, and autonomous agents.
- Secure Communications: Open-source, privacy-first methods for secure, untraceable collaboration among researchers.
- 1. Discovery
- 2. Validation (Zero Trust Approach)
- 3. Categorization & Documentation
- Popular OSINT Tools
- Hidden Gems / Niche Tools
- AI-Powered OSINT Agents
- Expanded OSINT Toolkit
- Next-Era & Innovative AI OSINT Tools
- Expansive AI Platforms, Secure Comms & OSINT Frameworks
- Expansive AI Platforms, Secure Comms & OSINT Frameworks
- Massive Domain Expansion
- 🏦 The AI Agents Vault
- 📚 Instructionals, Blueprints & Active Campaigns
- 🕵️ Automated Hunt Additions
- 🛡️ Counter Intelligence & Open Source Cybersecurity
- 🕸️ Data Scrapers, Dark Web, & Corporate Recon
- 🏛️ Government OSINT, Forensics, & Financial Tracking
While this repository serves as the definitive directory of external tools, we are actively developing an extensible, modular engine to unify data ingestion and AI processing: OSINT Platform Project. Check it out for a hands-on, API-driven intelligence backend.
Curate a comprehensive directory of open-source intelligence (OSINT) tools, encompassing both widely recognized industry standards and obscure, highly specific 'hidden gems' (including those with very few stars or recent creation dates).
- Popular Tools: Well-known, highly starred, and actively maintained repositories.
- Hidden Gems: Niche, lesser-known projects, potentially with <=1 star, that provide unique capabilities.
Use GitHub API or other search mechanisms to discover repositories using OSINT-related topics and keywords.
- Query A (Popular): Sort by stars (descending) to capture mainstream tools.
- Query B (Niche): Sort by recently updated or created, with specific niche keywords, ignoring star count, to find hidden gems.
- Active Maintenance: Check if the repository has been updated within the last 24 months.
- Security Posture: Verify absence of critical unpatched vulnerabilities or explicitly malicious behavior.
- Group tools into logical categories: 'Popular OSINT Tools' and 'Hidden Gems / Niche Tools'.
- Maintain standard community files (LICENSE, CODE_OF_CONDUCT.md, CONTRIBUTING.md) and disclaimers.
A structured Markdown document (README.md) containing the categorized lists with descriptions, star counts, and last updated dates.
- Description: Hunt down social media accounts by username across social networks
- Stars: 85042
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface
- Stars: 56480
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: 🕵️♂️ All-in-one OSINT tool for analysing any website
- Stars: 33682
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: 🕵️♂️ Collect a dossier on a person by username from 3000+ sites
- Stars: 33109
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: 😱 A curated list of amazingly awesome OSINT
- Stars: 26811
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites
- Stars: 23045
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Web Extension for saving a faithful copy of a complete web page in a single HTML file
- Stars: 21581
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: 🕵️♂️ Offensive Google framework.
- Stars: 19077
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
- Stars: 18184
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Information gathering framework for phone numbers
- Stars: 16643
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: E-mails, subdomains and names Harvester - OSINT
- Stars: 16472
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a user's followers, following, Tweets and more while evading most API limitations.
- Stars: 16384
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: 754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 26 security domains · Apache 2.0
- Stars: 15771
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: In-depth attack surface mapping and asset discovery
- Stars: 14709
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Useful tool to track location or mobile number
- Stars: 14076
- Last Updated: 2026-06-15
- Validation Status: Passed
Hidden Gems / Niche Tools
- Description: A global OSINT Interactive CLI for any platform and language you desire
- Stars: 9
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Conteneur Docker tout-en-un pour l'investigation numérique, incluant des outils préinstallés pour l'analyse forensique de disques, mémoire, malwares et appareils mobiles.
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Telegram cybersecurity channels
- Stars: 3
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: A professional multi-agent team framework optimized for Google Antigravity 2.0 to perform comprehensive Lobby & Interest Mapping (lobby- en belangenmapping) in the Netherlands.
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Machine-readable .txt list of domains from the Estonian Internet Foundation zonefile, updated once a day.
- Stars: 4
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Machine-readable .txt lists of domains from the Internetstiftelsen (Swedish Internet Foundation) zonefiles, updated once a day.
- Stars: 5
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Webová prověrka českých firem a jejich propojení — agreguje ARES, OR, RŽP, ADIS DPH, ISIR, ČNB JERRS, EU sankce a Hlídač státu do risk skóre + holding discovery + cross-company graph. AGPL-3.0.
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: OSINT/GEOINT geolocation archive for armed-conflict events — open source under AGPL-3.0
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Serverless Data Engine & Static JSON API powering the AlaskaIntel ecosystem.
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Noclip Engine for spectral decomposition of the information graph and structural gap detection
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: OSINT tool that crawls Telegram channels, builds a directed reference graph, and exports data, stats and an interactive network map for political communication research.
- Stars: 8
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Advanced Secret Finder made in Rust Language, made only for educacional.
- Stars: 7
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: A historical registry of crypto exchanges, tracking active, dead, merged, acquired, and rebranded entities.
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Spectre AI 2026: Next-Gen OSINT Engine & Autonomous Graph Disambiguation Toolkit
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Infowitz · CIB TikTok — Détection de comportements inauthentiques coordonnés (CIB) sur TikTok
- Stars: 0
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: 754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 26 security domains · Apache 2.0
- Stars: 15775
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
- Stars: 10246
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Open-source intelligence for the global theater. Track everything from the corporate/private jets of the wealthy, and spy satellites, to seismic events in one unified interface. Hook an AI agent up to have it parse through data and find previously unseen correlations. The knowledge is available to all but rarely aggregated in the open, until now.
- Stars: 9243
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention.
- Stars: 1988
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Fetch X/Twitter tweets, replies, timelines, and articles without login or API keys — field tool for AI agents.
- Stars: 875
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.
- Stars: 827
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 16 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
- Stars: 655
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: Provide AI agents with full Tor network access and dark web data through a zero-config OpenClaw skill or standalone tool.
- Stars: 207
- Last Updated: 2026-06-15
- Validation Status: Passed
- Description: X Intelligence CLI — search, monitor, analyze, and engage on X/Twitter. TypeScript + Bun. AI agent skill. Using xAPI & xAI api keys
- Stars: 154
- Last Updated: 2026-06-14
- Validation Status: Passed
- Description: 🤖 Curated AI OSINT resources — Google dorks, Shodan queries, GitHub dorks, and techniques to discover exposed LLM endpoints, leaked AI API keys, misconfigured vector databases, and unprotected AI agents
- Stars: 91
- Last Updated: 2026-06-14
- Validation Status: Passed
The following tools were discovered and added to expand our repository capabilities. Explicit care has been taken to identify the ownership and origin of these tools to respect the creators and organizations behind them.
- Description: Fast passive subdomain enumeration tool.
- Origin & Ownership: Owned and maintained by projectdiscovery (Entity Type: Organization). Licensed under: MIT License.
- Stars: 13847 | Last Updated: 2026-06-15
- Description: OSINT Framework
- Origin & Ownership: Owned and maintained by lockfale (Entity Type: Organization). Licensed under: MIT License.
- Stars: 11487 | Last Updated: 2026-06-15
- Description: reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
- Origin & Ownership: Owned and maintained by yogeshojha (Entity Type: User). Licensed under: GNU General Public License v3.0.
- Stars: 8694 | Last Updated: 2026-06-15
- Description: reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
- Origin & Ownership: Owned and maintained by six2dez (Entity Type: User). Licensed under: MIT License.
- Stars: 7703 | Last Updated: 2026-06-15
- Description: A Modern Orchestration Engine for Security
- Origin & Ownership: Owned and maintained by j3ssie (Entity Type: User). Licensed under: MIT License.
- Stars: 6419 | Last Updated: 2026-06-15
Continuing the expansion into next-generation methodologies, cutting-edge graph structures, and specialized AI agents (both viral and niche).
arn-c0de/Crawllama - Ai Agents
- Description: CrawlLama 🦙 is an local AI agent that answers questions via Ollama and integrates web- and RAG-based research.
- Origin & Ownership: Owned and maintained by arn-c0de (Entity Type: User). Licensed under: Other.
- Stars: 63 | Last Updated: 2026-06-13
bm-github/owasp-social-osint-agent - Ai Agents
- Description: AI-powered OSINT framework for multi-platform social media intelligence gathering using OpenAI-compatible APIs. Features vision analysis, network mapping, and dual web/CLI interfaces.
- Origin & Ownership: Owned and maintained by bm-github (Entity Type: User). Licensed under: MIT License.
- Stars: 78 | Last Updated: 2026-06-13
smixs/osint-skill - Ai Agents
- Description: OSINT Skill for AI agents (Claude Code, OpenClaw, Codex, OpenCode) — from a name to a scored dossier with psychoprofile, career map, and confidence grades. 55+ Apify actors, 7 search APIs, swarm mode. Early Beta.
- Origin & Ownership: Owned and maintained by smixs (Entity Type: User). Licensed under: MIT License.
- Stars: 59 | Last Updated: 2026-06-15
pete731/sati - Niche Ai Agents
- Description: 🤖 Establish verifiable identities and reputations for AI agents on Solana with SATI, bridging gaps in agent infrastructure and payment management.
- Origin & Ownership: Owned and maintained by pete731 (Entity Type: User). Licensed under: Apache License 2.0.
- Stars: 1 | Last Updated: 2026-06-15
winless-boozing857/agent-lens - Niche Ai Agents
- Description: Track multi-session agent runs with Claude Agent SDK, store them in ATIF, and track file state changes for alignment research
- Origin & Ownership: Owned and maintained by winless-boozing857 (Entity Type: User). Licensed under: MIT License.
- Stars: 1 | Last Updated: 2026-06-15
dublen5269/Sicry - Niche Ai Agents
- Description: Enable AI agents to access Tor and .onion sites with a simple Python layer supporting built-in search engines and OSINT tools.
- Origin & Ownership: Owned and maintained by dublen5269 (Entity Type: User). Licensed under: Other.
- Stars: 1 | Last Updated: 2026-06-15
doniboyd/IOC-Checker-Pro - Next Gen
- Description: 🛡️ Analyze IOCs in real-time with IOC Checker Pro, leveraging VirusTotal API for smart threat classification and efficient API limit management.
- Origin & Ownership: Owned and maintained by doniboyd (Entity Type: User). Licensed under: No License / Custom.
- Stars: 0 | Last Updated: 2026-06-15
luoyinhu/MetaViewer - Next Gen
- Description: 🌌 Discover metadata from your images instantly with MetaViewer, a sleek, client-side web app for photographers and digital forensics enthusiasts.
- Origin & Ownership: Owned and maintained by luoyinhu (Entity Type: User). Licensed under: MIT License.
- Stars: 1 | Last Updated: 2026-06-15
elliotwutingfeng/ThreatFox-IOC-IPs - Next Gen
- Description: Machine-readable .txt IP blocklist from ThreatFox by Abuse.ch, updated every hour.
- Origin & Ownership: Owned and maintained by elliotwutingfeng (Entity Type: User). Licensed under: BSD 3-Clause "New" or "Revised" License.
- Stars: 55 | Last Updated: 2026-06-15
A comprehensive addition of large-scale AI ecosystems, open-source secure communication platforms, and overarching intelligence frameworks.
AXRoux/OSINT-Assistant - Ai Platforms
- Description: Open Source framework for anyone to work with Perplexity Sonar
- Origin & Ownership: Owned and maintained by AXRoux (User). Licensed under: MIT License.
- Stars: 76 | Last Updated: 2026-06-12
ExploitCraft/ReconNinja - Ai Platforms
- Description: ⚡ ReconNinja v9.1.2 — 38-phase recon framework for pentesters & bug bounty hunters. Subdomain enum → port scan → web recon → WAF/CORS/JS/cloud bucket detection → GitHub OSINT → CVE lookup → AI threat analysis → HTML report. Domains, IPs, CIDRs, target lists. Plugin system. 598 tests.
- Origin & Ownership: Owned and maintained by ExploitCraft (User). Licensed under: MIT License.
- Stars: 39 | Last Updated: 2026-06-15
forensic-toolkit/recops - Ai Platforms
- Description: recops is a facial analysis framework, an AI forensic toolkit designed specifically for visual investigations and analysis workflows in OSINT research.
- Origin & Ownership: Owned and maintained by forensic-toolkit (Organization). Licensed under: Other.
- Stars: 16 | Last Updated: 2026-04-08
usr2r00t/OASC - Ai Platforms
- Description: OpenAI Security Console - Python3 AI-powered Cybersecurity Framework
- Origin & Ownership: Owned and maintained by usr2r00t (User). Licensed under: No License / Custom.
- Stars: 16 | Last Updated: 2025-10-21
MohakTech/Cloak - Secure Comms
- Description: Cloak 🛡️ | Decentralized & Encrypted Chat A privacy-focused, open-source chat platform leveraging blockchain authentication, end-to-end encryption, and a Tor-like routing system for truly secure and anonymous communication. No central authority. No data tracking. Just pure privacy.
- Origin & Ownership: Owned and maintained by MohakTech (Organization). Licensed under: No License / Custom.
- Stars: 1 | Last Updated: 2025-03-08
ManuYT-dev/PeerCord - Secure Comms
- Description: PeerCord is a decentralized, open-source P2P communication platform built to function like Discord. By replacing central servers with direct peer-to-peer connections, it offers secure, privacy-first voice, video, and text chat. Enjoy high-quality, serverless communities controlled entirely by you and your peers.
- Origin & Ownership: Owned and maintained by ManuYT-dev (User). Licensed under: MIT License.
- Stars: 1 | Last Updated: 2026-05-17
gungwang/gungchat - Secure Comms
- Description: GungChat (敢说) 目前最安全的点对点加密通讯应用程序：100%保密、完全隐私、无用户数据泄露、无登录、无服务器依赖、点对点、完全匿名、数据加密、无广告、无追踪、完全自主控制、短信、语音通话、视频通话、开源免费。GungChat puts privacy first. This open‑source P2P messenger encrypts every text, call, and video—without accounts or servers. No tracking, no ads, just secure communication with total freedom.
- Origin & Ownership: Owned and maintained by gungwang (User). Licensed under: No License / Custom.
- Stars: 1 | Last Updated: 2026-05-28
graniet/operative-framework - General Osint
- Description: operative framework is a rust investigation OSINT framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules.
- Origin & Ownership: Owned and maintained by graniet (User). Licensed under: No License / Custom.
- Stars: 744 | Last Updated: 2026-06-15
techenthusiast167/D4rk_Intel-OSINT-Investigative-Toolkit - General Osint
- Description: A curated toolkit for Open-Source Intelligence (OSINT) investigations. This repository contains a collection of scripts, resources, and methodologies to aid in gathering and analyzing publicly available information. Designed for security researchers, journalists, and forensic analysts for ethical and legal investigations.
- Origin & Ownership: Owned and maintained by techenthusiast167 (User). Licensed under: No License / Custom.
- Stars: 330 | Last Updated: 2026-06-15
AnonCatalyst/Coeus-OSINT-ToolBox - General Osint
- Description: Coeus 🌐 is an OSINT ToolBox empowering users with tools for effective intelligence gathering from open sources. From social media monitoring 📱 to data analysis 📊, it offers a centralized platform for seamless OSINT investigations.
- Origin & Ownership: Owned and maintained by AnonCatalyst (User). Licensed under: MIT License.
- Stars: 228 | Last Updated: 2026-06-15
JambaAcademy/OSINT - General Osint
- Description: Companion repo for A Complete Guide to Mastering OSINT (2025). Includes free templates ($5,000 value), latest 2025 OSINT tools, and resources for ethical intelligence gathering. Supports book chapters on social media, cryptocurrency, and more. Ideal for investigators and cybersecurity pros. github.com/JambaAcademy/OSINT
- Origin & Ownership: Owned and maintained by JambaAcademy (User). Licensed under: MIT License.
- Stars: 101 | Last Updated: 2026-06-11
A comprehensive addition of large-scale AI ecosystems, open-source secure communication platforms, and overarching intelligence frameworks.
AXRoux/OSINT-Assistant - Ai Platforms
- Description: Open Source framework for anyone to work with Perplexity Sonar
- Origin & Ownership: Owned and maintained by AXRoux (User). Licensed under: MIT License.
- Stars: 76 | Last Updated: 2026-06-12
ExploitCraft/ReconNinja - Ai Platforms
- Description: ⚡ ReconNinja v9.1.2 — 38-phase recon framework for pentesters & bug bounty hunters. Subdomain enum → port scan → web recon → WAF/CORS/JS/cloud bucket detection → GitHub OSINT → CVE lookup → AI threat analysis → HTML report. Domains, IPs, CIDRs, target lists. Plugin system. 598 tests.
- Origin & Ownership: Owned and maintained by ExploitCraft (User). Licensed under: MIT License.
- Stars: 39 | Last Updated: 2026-06-15
forensic-toolkit/recops - Ai Platforms
- Description: recops is a facial analysis framework, an AI forensic toolkit designed specifically for visual investigations and analysis workflows in OSINT research.
- Origin & Ownership: Owned and maintained by forensic-toolkit (Organization). Licensed under: Other.
- Stars: 16 | Last Updated: 2026-04-08
usr2r00t/OASC - Ai Platforms
- Description: OpenAI Security Console - Python3 AI-powered Cybersecurity Framework
- Origin & Ownership: Owned and maintained by usr2r00t (User). Licensed under: No License / Custom.
- Stars: 16 | Last Updated: 2025-10-21
MohakTech/Cloak - Secure Comms
- Description: Cloak 🛡️ | Decentralized & Encrypted Chat A privacy-focused, open-source chat platform leveraging blockchain authentication, end-to-end encryption, and a Tor-like routing system for truly secure and anonymous communication. No central authority. No data tracking. Just pure privacy.
- Origin & Ownership: Owned and maintained by MohakTech (Organization). Licensed under: No License / Custom.
- Stars: 1 | Last Updated: 2025-03-08
ManuYT-dev/PeerCord - Secure Comms
- Description: PeerCord is a decentralized, open-source P2P communication platform built to function like Discord. By replacing central servers with direct peer-to-peer connections, it offers secure, privacy-first voice, video, and text chat. Enjoy high-quality, serverless communities controlled entirely by you and your peers.
- Origin & Ownership: Owned and maintained by ManuYT-dev (User). Licensed under: MIT License.
- Stars: 1 | Last Updated: 2026-05-17
gungwang/gungchat - Secure Comms
- Description: GungChat (敢说) 目前最安全的点对点加密通讯应用程序：100%保密、完全隐私、无用户数据泄露、无登录、无服务器依赖、点对点、完全匿名、数据加密、无广告、无追踪、完全自主控制、短信、语音通话、视频通话、开源免费。GungChat puts privacy first. This open‑source P2P messenger encrypts every text, call, and video—without accounts or servers. No tracking, no ads, just secure communication with total freedom.
- Origin & Ownership: Owned and maintained by gungwang (User). Licensed under: No License / Custom.
- Stars: 1 | Last Updated: 2026-05-28
graniet/operative-framework - General Osint
- Description: operative framework is a rust investigation OSINT framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules.
- Origin & Ownership: Owned and maintained by graniet (User). Licensed under: No License / Custom.
- Stars: 744 | Last Updated: 2026-06-15
techenthusiast167/D4rk_Intel-OSINT-Investigative-Toolkit - General Osint
- Description: A curated toolkit for Open-Source Intelligence (OSINT) investigations. This repository contains a collection of scripts, resources, and methodologies to aid in gathering and analyzing publicly available information. Designed for security researchers, journalists, and forensic analysts for ethical and legal investigations.
- Origin & Ownership: Owned and maintained by techenthusiast167 (User). Licensed under: No License / Custom.
- Stars: 330 | Last Updated: 2026-06-15
AnonCatalyst/Coeus-OSINT-ToolBox - General Osint
- Description: Coeus 🌐 is an OSINT ToolBox empowering users with tools for effective intelligence gathering from open sources. From social media monitoring 📱 to data analysis 📊, it offers a centralized platform for seamless OSINT investigations.
- Origin & Ownership: Owned and maintained by AnonCatalyst (User). Licensed under: MIT License.
- Stars: 228 | Last Updated: 2026-06-15
JambaAcademy/OSINT - General Osint
- Description: Companion repo for A Complete Guide to Mastering OSINT (2025). Includes free templates ($5,000 value), latest 2025 OSINT tools, and resources for ethical intelligence gathering. Supports book chapters on social media, cryptocurrency, and more. Ideal for investigators and cybersecurity pros. github.com/JambaAcademy/OSINT
- Origin & Ownership: Owned and maintained by JambaAcademy (User). Licensed under: MIT License.
- Stars: 101 | Last Updated: 2026-06-11
Expanding the ecosystem to maximize potential across highly specialized intelligence domains.
ninoseki/mihari - threat-intel
- Description: A query aggregator for OSINT based threat hunting
- Stars: 938
stanfrbd/cyberbro - threat-intel
- Description: A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
- Stars: 665
matamorphosis/Scrummage - threat-intel
- Description: A Holistic OSINT and Threat Hunting Platform
- Stars: 535
KatrielMoses/voidaccess - threat-intel
- Description: Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
- Stars: 246
aryanguenthner/darkfox - threat-intel
- Description: CTI Cyber Threat Intelligence OSINT Dark Web Deep Web Research. Ransomware gang information gathering tool.
- Stars: 154
reconurge/flowsint - crypto-osint
- Description: A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators.
- Stars: 6712
kpcyrd/sn0int - crypto-osint
- Description: Semi-automatic OSINT framework and package manager
- Stars: 2451
Ph055a/OSINT_Collection - crypto-osint
- Description: Maintained collection of OSINT related resources. (All Free & Actionable)
- Stars: 2372
kaifcodec/user-scanner - crypto-osint
- Description: 🕵️♂️ (2-in-1) Email & Username OSINT suite for deep data extraction. Analyzes 240+ scan vectors (100+ email / 140+ username) for security research, investigations, and digital footprinting.
- Stars: 2201
OffcierCia/On-Chain-Investigations-Tools-List - crypto-osint
- Description: Here we discuss how one can investigate crypto hacks and security incidents, and collect all the possible tools and manuals! PRs are welcome! If any tool is missing - please open PR!
- Stars: 1900
Datalux/Osintgram - geo-osint
- Description: Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
- Stars: 13173
s0md3v/Photon - geo-osint
- Description: Incredibly fast crawler designed for OSINT.
- Stars: 12951
instaloader/instaloader - geo-osint
- Description: Download pictures (or videos) along with their captions and other metadata from Instagram.
- Stars: 12567
megadose/holehe - geo-osint
- Description: holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.
- Stars: 11273
edoardottt/awesome-hacker-search-engines - geo-osint
- Description: A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
- Stars: 10765
techenthusiast167/DeepWebHarvester - darkweb-osint
- Description: A stealthy Python dark web scraper using Tor. Crawl .onion sites anonymously, with retries, rate-limiting, and automatic Tor circuit renewal. Created for ethical OSINT with a hacker vibe. Handle pages, extract links, save data safely.
- Stars: 77
chiasmod0n/chiasmodon - leak-osint
- Description: Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.
- Stars: 692
estebanpdl/osintgpt - leak-osint
- Description: An open-source intelligence (OSINT) analysis tool leveraging GPT-powered embeddings and vector search engines for efficient data processing
- Stars: 513
ni5arga/sightline - leak-osint
- Description: An OSINT search engine for mapping real-world infrastructure from OpenStreetMap data
- Stars: 482
The-Osint-Toolbox/People-Search-OSINT - leak-osint
- Description: Search tools to help you find people, focused towards UK resources.
- Stars: 149
NexvisionLab/Darkweb-search-engine - leak-osint
- Description: Dark Web & Deep Web Search Engine. Data Crawler and indexer for Darkweb , OSINT Tools for the Dark Web
- Stars: 135
A deep-dive collection of autonomous AI agents, LLM-powered crawlers, and experimental GPT wrappers specifically tailored for intelligence gathering. This is the bleeding edge of AI OSINT.
- Description: Deliver comprehensive AI-driven security operations with vulnerability scanning, incident response, compliance tracking, and autonomous agents in one platform.
- Owner: ydavidcm9-wq | Stars: 0
- Description: Automate security testing and vulnerability research with Ollama, MCP tools, dual RAG knowledge bases, and autonomous multi-agent orchestration.
- Owner: subsaharan-metallic807 | Stars: 0
- Description: Agentic OSINT toolkit. Autonomous identity triangulation, 6-dimension cognitive profiling, breach analysis. CLI-first. 30+ platforms. 5 languages.
- Owner: Doble-2 | Stars: 166
- Description: 🛰️Vanguard Agent is an autonomous OSINT multi-agent orchestrator for complex, governed security workflows. Built with Next.js 16 and LangGraph, it implements a Supervisor–Scout–Auditor pipeline with HITL-gated ReAct loops, Redis-backed checkpointing, MCP-integrated tooling, and a NIST-aligned audit ledger for traceable, approval-gated execution.
- Owner: GeorgianaAI | Stars: 0
- Description: 把全网信息变成可行动的情报 — 开源智能情报平台
- Owner: petterobam | Stars: 1
- Description: Provide a unified context intelligence layer for AI agents with seamless integration and full capability in a single Python package.
- Owner: armmammothermography417 | Stars: 1
- Description: Inject a sharp, unfiltered, and critical personality into your AI agents for more human-like, blunt, and engaging chatbot interactions.
- Owner: maged23ww | Stars: 0
- Description: Enable AI agents to fully control and interact with macOS apps, automating tasks like emailing, clicking, and form filling seamlessly.
- Owner: Judaca73 | Stars: 0
- Description: 💼 Analyze financial instruments with AI agents collaborating to provide consensus-based trading insights, simulating a hedge fund's decision-making process.
- Owner: Aurionlol | Stars: 1
A massive expansion encompassing educational blueprints, methodology guides, and active open-source intelligence campaigns. This section is dedicated to the 'how-to' and real-world investigations of modern OSINT.
Lifka/hacking-resources - Instructionals Blueprints
- Description: Hacking resources and cheat sheets. References, tools, scripts, tutorials, and other resources that help offensive and defensive security professionals.
- Owner: Lifka | Stars: 2497 | Last Updated: 2026-06-13
Jieyab89/OSINT-Cheat-sheet - Instructionals Blueprints
- Description: OSINT cheat sheet, list OSINT tools, wiki, dataset, article, book , red team OSINT for hackers and OSINT tips and OSINT branch. This repository will grow every time will research, there is a research, science and technology, tutorial. Please use it wisely.
- Owner: Jieyab89 | Stars: 1973 | Last Updated: 2026-06-15
cipher387/OSINT-Github-profiles - Instructionals Blueprints
- Description: A list of Github users who distribute tools and tutorials on OSINT (as well as hacking, pentest, and forensics)
- Owner: cipher387 | Stars: 114 | Last Updated: 2026-06-05
The-Osint-Toolbox/OSINT-Communities-Practitioners - Instructionals Blueprints
- Description: Search this list of OSINT Practitioners and learn about OSINT, it includes numerous, blogs and tutorials.
- Owner: The-Osint-Toolbox | Stars: 104 | Last Updated: 2026-05-15
0xSojalSec/read-dark-web - Instructionals Blueprints
- Description: A collection of awesome software, OSINT Tools, libraries, learning tutorials, documents, books & technical resources and cool stuff about dark web.
- Owner: 0xSojalSec | Stars: 99 | Last Updated: 2026-06-14
paulveillard/cybersecurity-osint - Instructionals Blueprints
- Description: An ongoing collection of awesome tools and frameworks, best security software practices, libraries, learning tutorials, frameworks, academic and practical resources about Open-source intelligence (OSINT) in cybersecurity.
- Owner: paulveillard | Stars: 36 | Last Updated: 2026-04-01
simplerhacking/Evilginx-Course - Instructionals Blueprints
- Description: Repository for uploading all extra resources for students enrolled in Simpler Hacking's Evilginx3 Pro Course
- Owner: simplerhacking | Stars: 33 | Last Updated: 2026-05-27
anthophilee/SpiderFoot- - Instructionals Blueprints
- Description: ادات جلب معلوماتUSES SpiderFoot can be used offensively (e.g. in a red team exercise or penetration test) for reconnaissance of your target or defensively to gather information about what you or your organisation might have exposed over the Internet. You can target the following entities in a SpiderFoot scan: IP address Domain/sub-domain name Hostname Network subnet (CIDR) ASN E-mail address Phone number Username Person's name Bitcoin address SpiderFoot's 200+ modules feed each other in a publisher/subscriber model to ensure maximum data extraction to do things like: Host/sub-domain/TLD enumeration/extraction Email address, phone number and human name extraction Bitcoin and Ethereum address extraction Check for susceptibility to sub-domain hijacking DNS zone transfers Threat intelligence and Blacklist queries API integration with SHODAN, HaveIBeenPwned, GreyNoise, AlienVault, SecurityTrails, etc. Social media account enumeration S3/Azure/Digitalocean bucket enumeration/scraping IP geo-location Web scraping, web content analysis Image, document and binary file meta data analysis Dark web searches Port scanning and banner grabbing Data breach searches So much more... INSTALLING & RUNNING To install and run SpiderFoot, you need at least Python 3.6 and a number of Python libraries which you can install with pip. We recommend you install a packaged release since master will often have bleeding edge features and modules that aren't fully tested. Stable build (packaged release): $ wget https://github.com/smicallef/spiderfoot/archive/v3.3.tar.gz $ tar zxvf v3.3.tar.gz $ cd spiderfoot ~/spiderfoot$ pip3 install -r requirements.txt ~/spiderfoot$ python3 ./sf.py -l 127.0.0.1:5001 Development build (cloning git master branch): $ git clone https://github.com/smicallef/spiderfoot.git $ cd spiderfoot $ pip3 install -r requirements.txt ~/spiderfoot$ python3 ./sf.py -l 127.0.0.1:5001 Check out the documentation and our asciinema videos for more tutorials. COMMUNITY Whether you're a contributor, user or just curious about SpiderFoot and OSINT in general, we'd love to have you join our community! SpiderFoot now has a Discord server for chat, and a Discourse server to serve as a more permanent knowledge base.
- Owner: anthophilee | Stars: 30 | Last Updated: 2026-06-13
WebBreacher/WhatsMyName - Active Campaigns
- Description: Community-maintained dataset of 700+ websites for finding accounts by username — powers OSINT and digital footprint tools.
- Owner: WebBreacher | Stars: 2576 | Last Updated: 2026-06-15
Jieyab89/OSINT-Cheat-sheet - Active Campaigns
- Description: OSINT cheat sheet, list OSINT tools, wiki, dataset, article, book , red team OSINT for hackers and OSINT tips and OSINT branch. This repository will grow every time will research, there is a research, science and technology, tutorial. Please use it wisely.
- Owner: Jieyab89 | Stars: 1973 | Last Updated: 2026-06-15
Cgboal/SonarSearch - Active Campaigns
- Description: A rapid API for the Project Sonar dataset
- Owner: Cgboal | Stars: 656 | Last Updated: 2026-06-05
sa7mon/venmo-data - Active Campaigns
- Description: Venmo trasaction dataset for data analysis/visualization/anything
- Owner: sa7mon | Stars: 208 | Last Updated: 2026-04-08
goldenowlosint/Islamic-Republic-Influence-Networks - Active Campaigns
- Description: 📊 OSINT dataset of 10,700+ Twitter/X accounts linked to Islamic Republic influence networks. Metadata-only for CIB research & network analysis.
- Owner: goldenowlosint | Stars: 76 | Last Updated: 2026-06-11
soxoj/bellingcat-hackathon-watchcats - Active Campaigns
- Description: 📊 Adana - 1-click analytical dashboard for OSINT researchers
- Owner: soxoj | Stars: 45 | Last Updated: 2026-06-15
3xp0rt/Naminter - Active Campaigns
- Description: A Python package and command-line interface (CLI) tool for asynchronous OSINT username enumeration using the WhatsMyName dataset
- Owner: 3xp0rt | Stars: 44 | Last Updated: 2026-05-31
SagarBiswas-MultiHAT/Phoneint-OSINT-Toolkit - Active Campaigns
- Description: Phoneint-OSINT-Toolkit — a privacy-first phone-number OSINT toolkit (CLI + minimal GUI). Parses and normalizes numbers (E.164), enriches with deterministic metadata, runs optional async adapters (DuckDuckGo, Google, public datasets), computes explainable risk scores and owner intelligence, and exports JSON/CSV/PDF reports.
- Owner: SagarBiswas-MultiHAT | Stars: 24 | Last Updated: 2026-06-09
OpenCTI-Platform/opencti - Hot Topics
- Description: Open Cyber Threat Intelligence Platform
- Owner: OpenCTI-Platform | Stars: 9552 | Last Updated: 2026-06-15
intelowlproject/IntelOwl - Hot Topics
- Description: IntelOwl: manage your Threat Intelligence at scale
- Owner: intelowlproject | Stars: 4598 | Last Updated: 2026-06-14
ivre/ivre - Hot Topics
- Description: Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
- Owner: ivre | Stars: 4045 | Last Updated: 2026-06-15
bhavsec/reconspider - Hot Topics
- Description: 🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.
- Owner: bhavsec | Stars: 2709 | Last Updated: 2026-06-15
ARPSyndicate/awesome-intelligence - Hot Topics
- Description: A collaboratively curated list of awesome Open-Source Intelligence (OSINT) Resources
- Owner: ARPSyndicate | Stars: 2367 | Last Updated: 2026-06-15
evilsocket/xray - Hot Topics
- Description: XRay is a tool for recon, mapping and OSINT gathering from public networks.
- Owner: evilsocket | Stars: 2315 | Last Updated: 2026-06-14
vaguileradiaz/tinfoleak - Hot Topics
- Description: The most complete open-source tool for Twitter intelligence analysis
- Owner: vaguileradiaz | Stars: 1976 | Last Updated: 2026-06-14
utkusen/urlhunter - Hot Topics
- Description: a recon tool that allows searching on URLs that are exposed via shortener services
- Owner: utkusen | Stars: 1682 | Last Updated: 2026-06-14
Tools integrated via the Automated Investigation Prompt, focusing on complex challenges like threat actor profiling and autonomous intelligence.
- Category:
threat-actor-profiling - Description: AI OSINT Security Analyzer is an intelligent platform that leverages AI to perform autonomous investigations across various intelligence sources. With features like multi-source integration and real-time threat intelligence, it ensures comprehensive security assessments. 🛡️🔍
- Stars: 12 | Last Updated: 2026-06-15
- Category:
threat-actor-profiling - Description: Automate OSINT investigations and threat intelligence workflows with this Claude Code toolkit for case management and evidence collection.
- Stars: 3 | Last Updated: 2026-06-15
- Category:
threat-actor-profiling - Description: Finance & Banking - Advanced Threat Intelligence Plt. & Dynamic Policy Enforcer that ingests OSINT threat feeds, normalizes & scores indicators, stores intelligence in MongoDB, integrates with ELK SIEM, and automatically enforces firewall rules using Linux iptables for real-time threat mitigation.
- Stars: 10 | Last Updated: 2026-06-14
- Category:
autonomous-intel - Description: AI OSINT Security Analyzer is an intelligent platform that leverages AI to perform autonomous investigations across various intelligence sources. With features like multi-source integration and real-time threat intelligence, it ensures comprehensive security assessments. 🛡️🔍
- Stars: 12 | Last Updated: 2026-06-15
- Category:
autonomous-intel - Description: JARVIS: a real-time agentic intelligence-gathering platform powered by autonomous web scraping & OSINT, streamed via Meta Ray-Ban smart glasses
- Stars: 229 | Last Updated: 2026-06-15
- Category:
autonomous-intel - Description: 🔥 OSINT (Open Source Intelligence) analysis tool that uses the power of an autonomous AI agent
- Stars: 9 | Last Updated: 2026-06-09
Tools dedicated to defensive operations, identifying espionage, and broad open-source cybersecurity frameworks.
- Category:
counter-intel - Description: A TypeScript library for reading and manipulating Counter-Strike 2 game data
- Stars: 35 | Last Updated: 2026-06-15
- Category:
counter-intel - Description: 🏆 Major Winner: Counter Strike 2 的主播 Major 竞猜结果 & 排行一览
- Stars: 14 | Last Updated: 2026-06-15
- Category:
counter-intel - Description: New and improved version of CounterSpell
- Stars: 7 | Last Updated: 2026-06-15
- Category:
counter-intel - Description: 💶・Counter Strike 2 Prices Tracker
- Stars: 14 | Last Updated: 2026-06-15
- Category:
open-source-cybersecurity - Description: A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]
- Stars: 490 | Last Updated: 2026-06-15
- Category:
open-source-cybersecurity - Description: Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.
- Stars: 873 | Last Updated: 2026-06-15
- Category:
open-source-cybersecurity - Description: Open source cyber-serenity platform that help the security teams designing and managing companies' ISMS, and which allow them to create resilient digital systems with efficient responses against to cyber-threats.
- Stars: 19 | Last Updated: 2026-04-24
- Category:
open-source-cybersecurity - Description: CrowdSec is an open-source cyber security tool. This plugin blocks detected attackers or display them a captcha.
- Stars: 43 | Last Updated: 2026-01-09
Expanding into data extraction, deep web intelligence, and corporate footprinting for job hunting and reconnaissance.
- Category:
data-scrapers - Description: ⛏️ The extraction engine behind Maigret: turn any profile URL into a structured OSINT record across 150+ sites
- Stars: 1008 | Last Updated: 2026-06-15
- Category:
data-scrapers - Description: The Big Brother V5.0 is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
- Stars: 619 | Last Updated: 2026-06-15
- Category:
data-scrapers - Description: A user-friendly Python toolkit for open source intelligence, providing key features such as image geolocation, social media profiling, email breach checks, domain lookup, metadata extraction, Google dorking, Wayback Machine queries, IP geolocation with blacklist checks, reverse image search, among others.
- Stars: 397 | Last Updated: 2026-06-15
- Category:
data-scrapers - Description: WebRecon is an advanced Open Source Intelligence (OSINT) web reconnaissance tool designed for cybersecurity professionals, penetration testers, and security researchers. It automates the process of gathering intelligence from target websites through comprehensive crawling, data extraction, and analysis.
- Stars: 280 | Last Updated: 2026-06-15
- Category:
dark-web-osint - Description: AI-Powered Dark Web OSINT Tool
- Stars: 5485 | Last Updated: 2026-06-15
- Category:
dark-web-osint - Description: Dark Web OSINT Tool
- Stars: 4128 | Last Updated: 2026-06-15
- Category:
dark-web-osint - Description: OSINT Tools for the Dark Web
- Stars: 2212 | Last Updated: 2026-06-15
- Category:
dark-web-osint - Description: Prying Deep - An OSINT tool to collect intelligence on the dark web.
- Stars: 591 | Last Updated: 2026-06-11
- Category:
job-hunting-recon - Description: 🔍 Search anyone's digital footprint across 300+ websites
- Stars: 3418 | Last Updated: 2026-06-15
- Category:
job-hunting-recon - Description: The Offensive Manual Web Application Penetration Testing Framework.
- Stars: 1864 | Last Updated: 2026-06-15
- Category:
job-hunting-recon - Description: The Big Brother V5.0 is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
- Stars: 619 | Last Updated: 2026-06-15
- Category:
job-hunting-recon - Description: OSINT Template Engine
- Stars: 576 | Last Updated: 2026-06-14
- Category:
iot-vehicle-osint - Description: People tracker on the Internet: OSINT analysis and research tool by Jose Pino
- Stars: 8698 | Last Updated: 2026-06-15
- Category:
iot-vehicle-osint - Description: Track Instagram users' activities, profile changes and capture content with beautiful dashboards and instant notifications
- Stars: 1048 | Last Updated: 2026-06-15
- Category:
iot-vehicle-osint - Description: Zehef is an osint tool to track emails
- Stars: 1024 | Last Updated: 2026-06-08
- Category:
iot-vehicle-osint - Description: 🐙 Track down GitHub users.
- Stars: 999 | Last Updated: 2026-06-13
Expanding into official government materials, deep multimedia forensics, metadata analysis, and financial intelligence.
- Category:
gov-osint - Description: Citizen Intelligence Agency. Open-source intelligence platform analyzing Swedish political activities using AI and data visualization. Tracks politicians, government institutions, and parliamentary data, offering detailed insights, performance metrics, and advanced analytics.
- Stars: 228 | Last Updated: 2026-06-14
- Category:
gov-osint - Description: Surveillance camera network map - 336K+ cameras worldwide with inter-agency data sharing visualization
- Stars: 122 | Last Updated: 2026-06-14
- Category:
gov-osint - Description:
# Ukraine-Cyber-Operations Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional free threat intelligence. Slava Ukraini. Glory to Ukraine. (Blog | Twitter | LinkedIn) 
### Analyst Comments: - 2022-02-25 - Creation of the initial repository to help organisations in Ukraine - Added Threat Reports section - Added Vendor Support section - 2022-02-26 - Additional resources, chronologically ordered (h/t Orange-CD) - Added Vetted OSINT Sources section - Added Miscellaneous Resources section - 2022-02-27 - Additional threat reports have been added - Added Data Brokers section - Added Access Brokers section - 2022-02-28 - Added Russian Cyber Operations Against Ukraine Timeline by ETAC - Added Vetted and Contextualized Indicators of Compromise (IOCs) by ETAC - 2022-03-01 - Additional threat reports and resources have been added - 2022-03-02 - Additional Indicators of Compromise (IOCs) have been added - Added vetted YARA rule collection from the Threat Reports by ETAC - Added loosely-vetted IOC Threat Hunt Feeds by KPMG-Egyde CTI (h/t 0xDISREL) - IOCs shared by these feeds are LOW-TO-MEDIUM CONFIDENCE we strongly recommend NOT adding them to a blocklist - These could potentially be used for THREAT HUNTING and could be added to a WATCHLIST - IOCs are generated in MISP COMPATIBLE CSV format - 2022-03-03 - Additional threat reports and vendor support resources have been added - Updated Log4Shell IOC Threat Hunt Feeds by KPMG-Egyde CTI; not directly related to Ukraine, but still a widespread vulnerability. - Added diagram of Russia-Ukraine Cyberwar Participants 2022 by ETAC - Additional Indicators of Compromise (IOCs) have been added #### Threat Reports| Date | Source | Threat(s) | URL | | --- | --- | --- | --- | | 14 JAN | SSU Ukraine | Website Defacements | ssu.gov.ua| | 15 JAN | Microsoft | WhisperGate wiper (DEV-0586) | microsoft.com | | 19 JAN | Elastic | WhisperGate wiper (Operation BleedingBear) | elastic.github.io | | 31 JAN | Symantec | Gamaredon/Shuckworm/PrimitiveBear (FSB) | symantec-enterprise-blogs.security.com | | 2 FEB | RaidForums | Access broker "GodLevel" offering Ukrainain algricultural exchange | RaidForums [not linked] | | 2 FEB | CERT-UA | UAC-0056 using SaintBot and OutSteel malware | cert.gov.ua | | 3 FEB | PAN Unit42 | Gamaredon/Shuckworm/PrimitiveBear (FSB) | unit42.paloaltonetworks.com | | 4 FEB | Microsoft | Gamaredon/Shuckworm/PrimitiveBear (FSB) | microsoft.com | | 8 FEB | NSFOCUS | Lorec53 (aka UAC-0056, EmberBear, BleedingBear) | nsfocusglobal.com | | 15 FEB | CERT-UA | DDoS attacks against the name server of government websites as well as Oschadbank (State Savings Bank) & Privatbank (largest commercial bank). False SMS and e-mails to create panic | cert.gov.ua | | 23 FEB | The Daily Beast | Ukrainian troops receive threatening SMS messages | thedailybeast.com | | 23 FEB | UK NCSC | Sandworm/VoodooBear (GRU) | ncsc.gov.uk | | 23 FEB | SentinelLabs | HermeticWiper | sentinelone.com | | 24 FEB | ESET | HermeticWiper | welivesecurity.com | | 24 FEB | Symantec | HermeticWiper, PartyTicket ransomware, CVE-2021-1636, unknown webshell | symantec-enterprise-blogs.security.com | | 24 FEB | Cisco Talos | HermeticWiper | blog.talosintelligence.com | | 24 FEB | Zscaler | HermeticWiper | zscaler.com | | 24 FEB | Cluster25 | HermeticWiper | cluster25.io | | 24 FEB | CronUp | Data broker "FreeCivilian" offering multiple .gov.ua | twitter.com/1ZRR4H| | 24 FEB | RaidForums | Data broker "Featherine" offering diia.gov.ua | RaidForums [not linked] | | 24 FEB | DomainTools | Unknown scammers | twitter.com/SecuritySnacks | | 25 FEB | @500mk500 | Gamaredon/Shuckworm/PrimitiveBear (FSB) | twitter.com/500mk500 | | 25 FEB | @500mk500 | Gamaredon/Shuckworm/PrimitiveBear (FSB) | twitter.com/500mk500| | 25 FEB | Microsoft | HermeticWiper | gist.github.com | | 25 FEB | 360 NetLab | DDoS (Mirai, Gafgyt, IRCbot, Ripprbot, Moobot) | blog.netlab.360.com | | 25 FEB | Conti [themselves] | Conti ransomware, BazarLoader | Conti News .onion [not linked] | | 25 FEB | CoomingProject [themselves] | Data Hostage Group | CoomingProject Telegram [not linked] | | 25 FEB | CERT-UA | UNC1151/Ghostwriter (Belarus MoD) | CERT-UA Facebook| | 25 FEB | Sekoia | UNC1151/Ghostwriter (Belarus MoD) | twitter.com/sekoia_io | | 25 FEB | @jaimeblascob | UNC1151/Ghostwriter (Belarus MoD) | twitter.com/jaimeblasco| | 25 FEB | RISKIQ | UNC1151/Ghostwriter (Belarus MoD) | community.riskiq.com | | 25 FEB | MalwareHunterTeam | Unknown phishing | twitter.com/malwrhunterteam | | 25 FEB | ESET | Unknown scammers | twitter.com/ESETresearch | | 25 FEB | BitDefender | Unknown scammers | blog.bitdefender.com | | 25 FEB | SSSCIP Ukraine | Unkown phishing | twitter.com/dsszzi | | 25 FEB | RaidForums | Data broker "NetSec" offering FSB (likely SMTP accounts) | RaidForums [not linked] | | 25 FEB | Zscaler | PartyTicket decoy ransomware | zscaler.com | | 25 FEB | INCERT GIE | Cyclops Blink, HermeticWiper | linkedin.com [Login Required] | | 25 FEB | Proofpoint | UNC1151/Ghostwriter (Belarus MoD) | twitter.com/threatinsight | | 25 FEB | @fr0gger_ | HermeticWiper capabilities Overview | twitter.com/fr0gger_ | 26 FEB | BBC Journalist | A fake Telegram account claiming to be President Zelensky is posting dubious messages | twitter.com/shayan86 | | 26 FEB | CERT-UA | UNC1151/Ghostwriter (Belarus MoD) | CERT_UA Facebook | | 26 FEB | MHT and TRMLabs | Unknown scammers, linked to ransomware | twitter.com/joes_mcgill | | 26 FEB | US CISA | WhisperGate wiper, HermeticWiper | cisa.gov | | 26 FEB | Bloomberg | Destructive malware (possibly HermeticWiper) deployed at Ukrainian Ministry of Internal Affairs & data stolen from Ukrainian telecommunications networks | bloomberg.com | | 26 FEB | Vice Prime Minister of Ukraine | IT ARMY of Ukraine created to crowdsource offensive operations against Russian infrastructure | twitter.com/FedorovMykhailo | | 26 FEB | Yoroi | HermeticWiper | yoroi.company | | 27 FEB | LockBit [themselves] | LockBit ransomware | LockBit .onion [not linked] | | 27 FEB | ALPHV [themselves] | ALPHV ransomware | vHUMINT [closed source] | | 27 FEB | Mēris Botnet [themselves] | DDoS attacks | vHUMINT [closed source] | | 28 FEB | Horizon News [themselves] | Leak of China's Censorship Order about Ukraine | TechARP| | 28 FEB | Microsoft | FoxBlade (aka HermeticWiper) | Microsoft | | 28 FEB | @heymingwei | Potential BGP hijacks attempts against Ukrainian Internet Names Center | https://twitter.com/heymingwei | | 28 FEB | @cyberknow20 | Stormous ransomware targets Ukraine Ministry of Foreign Affairs | twitter.com/cyberknow20 | | 1 MAR | ESET | IsaacWiper and HermeticWizard | welivesecurity.com | | 1 MAR | Proofpoint | Ukrainian armed service member's email compromised and sent malspam containing the SunSeed malware (likely TA445/UNC1151/Ghostwriter) | proofpoint.com | | 1 MAR | Elastic | HermeticWiper | elastic.github.io | | 1 MAR | CrowdStrike | PartyTicket (aka HermeticRansom), DriveSlayer (aka HermeticWiper) | CrowdStrike | | 2 MAR | Zscaler | DanaBot operators launch DDoS attacks against the Ukrainian Ministry of Defense | zscaler.com | | 3 MAR | @ShadowChasing1 | Gamaredon/Shuckworm/PrimitiveBear (FSB) | twitter.com/ShadowChasing1 | | 3 MAR | @vxunderground | News website in Poland was reportedly compromised and the threat actor uploaded anti-Ukrainian propaganda | twitter.com/vxunderground | | 3 MAR | @kylaintheburgh | Russian botnet on Twitter is pushing "#istandwithputin" and "#istandwithrussia" propaganda (in English) | twitter.com/kylaintheburgh | | 3 MAR | @tracerspiff | UNC1151/Ghostwriter (Belarus MoD) | twitter.com | #### Access Brokers| Date | Threat(s) | Source | | --- | --- | --- | | 23 JAN | Access broker "Mont4na" offering UkrFerry | RaidForums [not linked] | | 23 JAN | Access broker "Mont4na" offering PrivatBank | RaidForums [not linked] | | 24 JAN | Access broker "Mont4na" offering DTEK | RaidForums [not linked] | | 27 FEB | KelvinSecurity Sharing list of IP cameras in Ukraine | vHUMINT [closed source] | | 28 FEB | "w1nte4mute" looking to buy access to UA and NATO countries (likely ransomware affiliate) | vHUMINT [closed source] | #### Data Brokers| Threat Actor | Type | Observation | Validated | Relevance | Source | | --------------- | --------------- | --------------------------------------------------------------------------------------------------------- | --------- | ----------------------------- | ---------------------------------------------------------- | | aguyinachair | UA data sharing | PII DB of ukraine.com (shared as part of a generic compilation) | No | TA discussion in past 90 days | ELeaks Forum [not linked] | | an3key | UA data sharing | DB of Ministry of Communities and Territories Development of Ukraine (minregion[.]gov[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | an3key | UA data sharing | DB of Ukrainian Ministry of Internal Affairs (wanted[.]mvs[.]gov[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (40M) of PrivatBank customers (privatbank[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | DB of "border crossing" DBs of DPR and LPR | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (7.5M) of Ukrainian passports | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB of Ukrainian car registration, license plates, Ukrainian traffic police records | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (2.1M) of Ukrainian citizens | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (28M) of Ukrainian citizens (passports, drivers licenses, photos) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (1M) of Ukrainian postal/courier service customers (novaposhta[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (10M) of Ukrainian telecom customers (vodafone[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (3M) of Ukrainian telecom customers (lifecell[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | CorelDraw | UA data sharing | PII DB (13M) of Ukrainian telecom customers (kyivstar[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | danieltx51 | UA data sharing | DB of Ministry of Foreign Affairs of Ukraine (mfa[.]gov[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | DueDiligenceCIS | UA data sharing | PII DB (63M) of Ukrainian citizens (name, DOB, birth country, phone, TIN, passport, family, etc) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | Featherine | UA data sharing | DB of Ukrainian 'Diia' e-Governance Portal for Ministry of Digital Transformation of Ukraine | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | FreeCivilian | UA data sharing | DB of Ministry for Internal Affairs of Ukraine public data search engine (wanted[.]mvs[.]gov[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | FreeCivilian | UA data sharing | DB of Ministry for Communities and Territories Development of Ukraine (minregion[.]gov[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | FreeCivilian | UA data sharing | DB of Motor Insurance Bureau of Ukraine (mtsbu[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | FreeCivilian | UA data sharing | PII DB of Ukrainian digital-medicine provider (medstar[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | FreeCivilian | UA data sharing | DB of ticket.kyivcity.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of id.kyivcity.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of my.kyivcity.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of portal.kyivcity.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of anti-violence-map.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of dopomoga.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of e-services.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of edu.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of education.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of ek-cbi.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mail.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of portal-gromady.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of web-minsoc.msp.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of wcs-wim.dsbt.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of bdr.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of motorsich.com | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of dsns.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mon.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of minagro.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of zt.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of kmu.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of dsbt.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of forest.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of nkrzi.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of dabi.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of comin.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of dp.dpss.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of esbu.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mms.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mova.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mspu.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of nads.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of reintegration.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of sies.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of sport.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mepr.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mfa.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of va.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mtu.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of cg.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of ch-tmo.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of cp.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of cpd.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of hutirvilnij-mrc.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of dndekc.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of visnyk.dndekc.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of dpvs.hsc.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of odk.mvs.gov.ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of e-driver[.]hsc[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of wanted[.]mvs[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of minregeion[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of health[.]mia[.]solutions | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mtsbu[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of motorsich[.]com | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of kyivcity[.]com | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of bdr[.]mvs[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of gkh[.]in[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of kmu[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mon[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of minagro[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | FreeCivilian | UA data sharing | DB of mfa[.]gov[.]ua | No | TA discussion in past 90 days | FreeCivilian .onion [not linked] | | Intel_Data | UA data sharing | PII DB (56M) of Ukrainian Citizens | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | Kristina | UA data sharing | DB of Ukrainian National Police (mvs[.]gov[.]ua) | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | NetSec | UA data sharing | PII DB (53M) of Ukrainian citizens | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | Psycho_Killer | UA data sharing | PII DB (56M) of Ukrainian Citizens | No | TA discussion in past 90 days | Exploit Forum .onion [not linked] | | Sp333 | UA data sharing | PII DB of Ukrainian and Russian interpreters, translators, and tour guides | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | Vaticano | UA data sharing | DB of Ukrainian 'Diia' e-Governance Portal for Ministry of Digital Transformation of Ukraine [copy] | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | | Vaticano | UA data sharing | DB of Ministry for Communities and Territories Development of Ukraine (minregion[.]gov[.]ua) [copy] | No | TA discussion in past 90 days | RaidForums [not linked; site hijacked since UA invasion] | #### Vendor Support| Vendor | Offering | URL | | --- | --- | --- | | Dragos | Access to Dragos service if from US/UK/ANZ and in need of ICS cybersecurity support | twitter.com/RobertMLee | | GreyNoise | Any and allUkrainianemails registered to GreyNoise have been upgraded to VIP which includes full, uncapped enterprise access to all GreyNoise products | twitter.com/Andrew___Morris | | Recorded Future | Providing free intelligence-driven insights, perspectives, and mitigation strategies as the situation in Ukraine evolves| recordedfuture.com | | Flashpoint | Free Access to Flashpoint’s Latest Threat Intel on Ukraine | go.flashpoint-intel.com | | ThreatABLE | A Ukraine tag for free threat intelligence feed that's more highly curated to cyber| twitter.com/threatable | | Orange | IOCs related to Russia-Ukraine 2022 conflict extracted from our Datalake Threat Intelligence platform. | github.com/Orange-Cyberdefense| | FSecure | F-Secure FREEDOME VPN is now available for free in all of Ukraine | twitter.com/FSecure | | Multiple vendors | List of vendors offering their services to Ukraine for free, put together by @chrisculling | docs.google.com/spreadsheets | | Mandiant | Free threat intelligence, webinar and guidance for defensive measures relevant to the situation in Ukraine. | mandiant.com | | Starlink | Satellite internet constellation operated by SpaceX providing satellite Internet access coverage to Ukraine | twitter.com/elonmusk | | Romania DNSC | Romania’s DNSC – in partnership with Bitdefender – will provide technical consulting, threat intelligence and, free of charge, cybersecurity technology to any business, government institution or private citizen of Ukraine for as long as it is necessary. | Romania's DNSC Press Release| | BitDefender | Access to Bitdefender technical consulting, threat intelligence and both consumer and enterprise cybersecurity technology | bitdefender.com/ukraine/ | | NameCheap | Free anonymous hosting and domain name registration to any anti-Putin anti-regime and protest websites for anyone located within Russia and Belarus | twitter.com/Namecheap | | Avast | Free decryptor for PartyTicket ransomware | decoded.avast.io | #### Vetted OSINT Sources| Handle | Affiliation | | --- | --- | | @KyivIndependent | English-language journalism in Ukraine | | @IAPonomarenko | Defense reporter with The Kyiv Independent | | @KyivPost | English-language journalism in Ukraine | | @Shayan86 | BBC World News Disinformation journalist | | @Liveuamap | Live Universal Awareness Map (“Liveuamap”) independent global news and information site | | @DAlperovitch | The Alperovitch Institute for Cybersecurity Studies, Founder & Former CTO of CrowdStrike | | @COUPSURE | OSINT investigator for Centre for Information Resilience | | @netblocks | London-based Internet's Observatory | #### Miscellaneous Resources| Source | URL | Content | | --- | --- | --- | | PowerOutages.com | https://poweroutage.com/ua | Tracking PowerOutages across Ukraine | | Monash IP Observatory | https://twitter.com/IP_Observatory | Tracking IP address outages across Ukraine | | Project Owl Discord | https://discord.com/invite/projectowl | Tracking foreign policy, geopolitical events, military and governments, using a Discord-based crowdsourced approach, with a current emphasis on Ukraine and Russia | | russianwarchatter.info | https://www.russianwarchatter.info/ | Known Russian Military Radio Frequencies | - Stars: 31 | Last Updated: 2026-06-06
- Category:
gov-osint - Description: A sophisticated Telegram bot for intelligence gathering and OSINT operations, developed for use by agencies under the Ministry of Defense.
- Stars: 8 | Last Updated: 2026-05-22
- Category:
gov-osint - Description: Riksdagsmonitor is a comprehensive intelligence platform for monitoring political activity in Sweden's Riksdag (Parliament). Built on the Citizen Intelligence Agency (CIA) platform, we provide systematic transparency through real-time analysis and 50+ years of historical data.
- Stars: 8 | Last Updated: 2026-06-15
- Category:
multimedia-forensics - Description: GeoIntel using Google's Gemini API to uncover the location where photos were taken through AI-powered geo-location analysis.
- Stars: 1061 | Last Updated: 2026-06-14
- Category:
multimedia-forensics - Description: ExifLooter finds geolocation on all image urls and directories also integrates with OpenStreetMap
- Stars: 490 | Last Updated: 2026-06-12
- Category:
multimedia-forensics - Description: Learn how to research images and the tools, techniques & tradecraft required.
- Stars: 477 | Last Updated: 2026-06-14
- Category:
multimedia-forensics - Description: Hackingtool Menu 🧰 AnonSurf Information Gathering Password Attack Wireless Attack SQL Injection Tools Phishing Attack Web Attack Tool Post exploitation Forensic Tools Payload Creator Router Exploit Wifi Jamming XSS Attack Tool Reverse Engineering SocialMedia Finder DDos Attack Tools Steganography Tools IDN Homograph Attack Hash Cracking Tools SocialMedia Attack Android Hack RAT Tools Web Crawling Payload Injector Update System AnonSurf Anonmously Surf Multitor Information Gathering Nmap Dracnmap Port Scanning Host To IP Xerosploit Infoga - Email OSINT ReconSpider RED HAWK (All In One Scanning) ReconDog Striker SecretFinder Port Scanner Breacher Password Attack Cupp WordlistCreator Goblin WordGenerator Credential reuse attacks Wordlist (Contain 1.4 Billion Pass) Wireless Attack WiFi-Pumpkin pixiewps Bluetooth Honeypot GUI Framework Fluxion Wifiphisher Wifite EvilTwin SQL Injection Tools sqlmap tool NoSqlMap Damn Small SQLi Scanner Explo Blisqy - Exploit Time-based blind-SQL injection Leviathan - Wide Range Mass Audit Toolkit SQLScan SocialMedia Attack Instagram Attack AllinOne SocialMedia Attack Facebook Attack Application Checker Android Attack Keydroid MySMS Lockphish (Grab target LOCK PIN) DroidCam (Capture Image) EvilApp (Hijack Session) Phishing Attack Setoolkit SocialFish HiddenEye Evilginx2 Shellphish BlackEye I-See-You(Get Location using phishing attack) SayCheese (Grab target's Webcam Shots) QR Code Jacking Web Attack SlowLoris Skipfish SubDomain Finder CheckURL Blazy Sub-Domain TakeOver Post Explotation Vegile - Ghost In The Shell Chrome Keylogger Forensic Tool Bulk_extractor Disk Clone and ISO Image Aquire AutoSpy Toolsley Wireshark Payload Generator The FatRat* Brutal Stitch MSFvenom Payload Creator Venom Shellcode Generator Spycam Mob-Droid Exploit Framework RouterSploit WebSploit Commix Web2Attack Fastssh SocialMedia Finder Find SocialMedia By Facial Recognation System Find SocialMedia By UserName Sherlock SocialScan Steganography SteganoHide StegnoCracker Whitespace Ddos Attack tool SlowLoris SYN Flood DDoS Weapon UFOnet GoldenEye XSS Attack tool DalFox(Finder of XSS) XSS Payload Generator Advanced XSS Detection Suite Extended XSS Searcher and Finder XSS-Freak XSpear XSSCon XanXSS IDN Homograph EvilURL Email Verifier KnockMail Hash Cracking Tool Hash Buster
- Stars: 323 | Last Updated: 2026-06-15
- Category:
multimedia-forensics - Description: A web based OSINT ressource and tool
- Stars: 197 | Last Updated: 2026-06-11
- Category:
financial-tracking - Description: Global threat map. Learn wars, conflicts, military bases and history of nations.
- Stars: 1649 | Last Updated: 2026-06-15
- Category:
financial-tracking - Description: Open Source Intelligence Interface for Deep Web Scraping
- Stars: 1609 | Last Updated: 2026-06-15
- Category:
financial-tracking - Description: An Instagram Open Source Intelligence Tool - Archive
- Stars: 1601 | Last Updated: 2026-06-14
- Category:
financial-tracking - Description: ClatScope Info Tool – The best and most versatile OSINT utility for retrieving geolocation, DNS, WHOIS, phone, email, data breach information and much more (70+ features). Perfect for investigators, pentesters, or anyone looking for an effective reconnaissance / OSINT tool.
- Stars: 1490 | Last Updated: 2026-06-15
- Category:
financial-tracking - Description: WireTapper is a wireless OSINT tool that passively detects and maps Wi-Fi, Bluetooth, CCTV cameras, vehicles, headphones, TVs, IoT devices, and cell towers, turning nearby radio signals into clear situational intelligence 📡
- Stars: 1439 | Last Updated: 2026-06-15
- Category:
metadata-analysis - Description: Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
- Stars: 2696 | Last Updated: 2026-06-15
- Category:
metadata-analysis - Description: 🕵️ OSINT Tools for gathering information and actions forensics 🕵️
- Stars: 2534 | Last Updated: 2026-06-14
- Category:
metadata-analysis - Description: Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
- Stars: 2400 | Last Updated: 2026-06-15
- Category:
metadata-analysis - Description: A curated list of tools officially presented at Black Hat events
- Stars: 815 | Last Updated: 2026-06-12
- Category:
metadata-analysis - Description: Tools OSINT MOBILE
- Stars: 677 | Last Updated: 2026-06-12
- Category:
social-specific - Description: The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.
- Stars: 3756 | Last Updated: 2026-06-15
- Category:
social-specific - Description: 📚 A Curated List of Awesome Telegram OSINT Tools, Sites & Resources
- Stars: 2730 | Last Updated: 2026-06-14
- Category:
social-specific - Description: In-depth repository of Telegram OSINT resources covering, tools, techniques & tradecraft.
- Stars: 1834 | Last Updated: 2026-06-15
- Category:
social-specific - Description: Public release of Telepathy, an OSINT toolkit for investigating Telegram chats.
- Stars: 1220 | Last Updated: 2026-06-14
- Category:
social-specific - Description: Matkap - hunt down malicious Telegram bots
- Stars: 951 | Last Updated: 2026-06-15
A dedicated expansion focusing on Large Language Models, Cybersecurity AI Agents, and Threat Intelligence AI systems to empower next-gen OSINT workflows.
- Category:
llm-osint-frameworks - Description: Automated collection, translation and analysis of open source intelligence using large language models.
- Stars: 39 | Last Updated: 2026-06-12
- Category:
cybersec-ai-agents - Description: SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
- Stars: 19522 | Last Updated: 2026-06-15
- Category:
cybersec-ai-agents - Description: HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
- Stars: 9597 | Last Updated: 2026-06-15
- Category:
cybersec-ai-agents - Description: Autonomous Hacking Agent for Red Team
- Stars: 4374 | Last Updated: 2026-06-15
- Category:
cybersec-ai-agents - Description: LuaN1aoAgent is a cognitive-driven AI hacker. It is a fully autonomous AI penetration testing agent, using dual-graph reasoning.
- Stars: 1036 | Last Updated: 2026-06-15
- Category:
cybersec-ai-agents - Description: Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)
- Stars: 852 | Last Updated: 2026-06-15
- Category:
threat-intel-ai - Description: [NeurIPS'24, Spotlight] CTIBench: A Benchmark for Evaluating LLMs in Cyber Threat Intelligence
- Stars: 86 | Last Updated: 2026-06-06
- Category:
threat-intel-ai - Description: CTINexus is a framework that leverages optimized in-context learning of LLMs to enable data-efficient extraction of cyber threat intelligence and the construction of high-quality cybersecurity knowledge graphs.
- Stars: 83 | Last Updated: 2026-06-13
- Category:
threat-intel-ai - Description: TTPMapper is an AI-driven threat intelligence parser that converts unstructured reports whether from web URLs or PDF files into structured intelligence. Using the DeepSeek LLM, it extracts MITRE ATT&CK techniques, IOCs, threat actors, and generates contextual summaries.
- Stars: 54 | Last Updated: 2026-05-28
- Category:
threat-intel-ai - Description: KQLIntel is a browser-based tool that uses LLMs to convert threat intelligence reports into actionable Kusto Query Language (KQL) queries by extracting IOCs from URLs or raw text.
- Stars: 31 | Last Updated: 2026-05-29
A comprehensive deep-dive into tools built for the Darknet, Deep Web, hacktivist/whitehat reconnaissance, and under-the-radar vulnerability intelligence.
- Category:
darknet-deepweb-core - Description: JSpider is a smart crawler for hidden endpoints. It crawls and extracts hidden API endpoints and URLs from JavaScript files and HTML source code - all directly in your browser.
- Stars: 16 | Last Updated: 2026-06-05
- Category:
darknet-deepweb-core - Description: POOPAK - TOR Hidden Service Crawler
- Stars: 139 | Last Updated: 2026-04-10
- Category:
darknet-deepweb-core - Description: 🕷️ | dezcrwl is a website history crawler gather hidden information and check vulnerabilities for extracted .js endpoints & much more!
- Stars: 7 | Last Updated: 2026-01-22
- Category:
whitehat-redteam-tools - Description: 🔌 A curated list of OSINT MCP servers. Pull requests are welcomed!
- Stars: 254 | Last Updated: 2026-06-15
- Category:
whitehat-redteam-tools - Description: European Parliament MCP Server Model Context Protocol Server for European Parliament Open Data Providing AI assistants with structured access to parliamentary datasets
- Stars: 16 | Last Updated: 2026-06-15
- Category:
whitehat-redteam-tools - Description: TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes.
- Stars: 661 | Last Updated: 2026-06-15
- Category:
next-era-automated-recon - Description: WebForensicAnalyzer is an advanced all-in-one tool for web reconnaissance, digital forensics, OSINT, and cybersecurity professionals. It automates deep website analysis—leveraging Shodan, Nmap, and more—to detect vulnerabilities, extract data, and deliver structured forensic results
- Stars: 13 | Last Updated: 2026-06-15
- Category:
next-era-automated-recon - Description: An advanced, asynchronous OSINT and Dark Web reconnaissance framework engineered for automated threat intelligence and leak analysis. Features high-concurrency investigative engines and exclusive SOCKS5 Tor routing to ensure maximum OPSEC without reliance on third-party APIs.
- Stars: 6 | Last Updated: 2026-06-14
- Category:
next-era-automated-recon - Description: UHT (Ufaq Hacking Toolkit) is a modern, modular, multi-OS cybersecurity and penetration-testing framework. It provides an advanced CLI for ethical hacking, OSINT, reconnaissance, exploitation, vulnerability scanning, and automated tool management across Linux, Termux, Windows, and macOS. Designed for professionals and beginners.
- Stars: 13 | Last Updated: 2026-05-26
- Category:
next-era-automated-recon - Description: High-performance OSINT/CTI framework for automated identity pivoting and risk analysis across 120+ sources.
- Stars: 188 | Last Updated: 2026-06-15
- Category:
under-the-radar-exploits - Description: 🛡️ Discover reflected XSS vulnerabilities with XSSRecon, an automated tool for testing URL parameters and assessing input handling in web applications.
- Stars: 3 | Last Updated: 2026-06-15
- Category:
under-the-radar-exploits - Description: Expert methodology for offensive and defensive security: recon/OSINT, vulnerability assessment, exploit dev, reverse engineering, malware analysis, threat hunting, incident response, network/web/cloud security, SOC automation, log/SIEM analysis, cryptography, red team, and blue team hardening.
- Stars: 1 | Last Updated: 2026-06-14
- Category:
under-the-radar-exploits - Description: Military-grade OSINT & Web Vulnerability Scanner — 27+ tools, AI-powered analysis, Docker-ready
- Stars: 0 | Last Updated: 2026-06-07
- Category:
under-the-radar-exploits - Description: An automated cyber recon tool built with Python. It combines OSINT APIs with Nmap and Nikto vulnerability scanning under one web interface. It also includes a quick Netcat reverse shell payload generator.
- Stars: 0 | Last Updated: 2026-05-31
Newly discovered, validated tools expanding our existing categories.
- Category:
threat-intel - Description: Cross-platform username reconnaissance tool built for OSINT investigators, cyber threat analysts, red teamers, and CTF enthusiasts.
- Stars: 134 | Last Updated: 2026-05-27
- Category:
threat-intel - Description: OSINT Threat Intel Interface - CLI for HoneyDB
- Stars: 118 | Last Updated: 2026-03-05
- Category:
threat-intel - Description: PCAP Hunter is an AI threat hunting workbench. It uses Zeek and Tshark to analyze PCAPs, enriched by OSINT. Features include a world map, JA3 forensics, and C2 detection. It generates multi-language security reports via local or cloud LLMs, prioritizing privacy and speed.
- Stars: 117 | Last Updated: 2026-06-13
- Category:
geo-osint - Description: httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.
- Stars: 10046 | Last Updated: 2026-06-15
- Category:
geo-osint - Description: OneForAll是一款功能强大的子域收集工具
- Stars: 9855 | Last Updated: 2026-06-15
- Category:
geo-osint - Description: iOS interview questions;iOS面试题集锦（附答案）
- Stars: 9526 | Last Updated: 2026-06-14
- Category:
leak-osint - Description: Automated Selenium-based scraper for PimEyes, enabling reverse face search for Open-Source Intelligence (OSINT) applications. Streamlined data extraction for enhanced investigative capabilities.
- Stars: 120 | Last Updated: 2026-06-09
- Category:
leak-osint - Description: Tool for OSINT forensic analysis, search and graphing of communications content such as email MBOX files and CSV text message data using Elasticsearch and Kibana
- Stars: 86 | Last Updated: 2026-06-12
- Category:
leak-osint - Description: Finds as much OSINT data as possible using email address as a search term.
- Stars: 76 | Last Updated: 2026-06-02
Newly discovered, validated tools expanding our existing categories.
- Category:
threat-intel - Description: Cross-platform username reconnaissance tool built for OSINT investigators, cyber threat analysts, red teamers, and CTF enthusiasts.
- Stars: 134 | Last Updated: 2026-05-27
- Category:
threat-intel - Description: OSINT Threat Intel Interface - CLI for HoneyDB
- Stars: 118 | Last Updated: 2026-03-05
- Category:
threat-intel - Description: PCAP Hunter is an AI threat hunting workbench. It uses Zeek and Tshark to analyze PCAPs, enriched by OSINT. Features include a world map, JA3 forensics, and C2 detection. It generates multi-language security reports via local or cloud LLMs, prioritizing privacy and speed.
- Stars: 117 | Last Updated: 2026-06-13
- Category:
geo-osint - Description: httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.
- Stars: 10046 | Last Updated: 2026-06-15
- Category:
geo-osint - Description: OneForAll是一款功能强大的子域收集工具
- Stars: 9855 | Last Updated: 2026-06-15
- Category:
geo-osint - Description: iOS interview questions;iOS面试题集锦（附答案）
- Stars: 9526 | Last Updated: 2026-06-14
- Category:
leak-osint - Description: Automated Selenium-based scraper for PimEyes, enabling reverse face search for Open-Source Intelligence (OSINT) applications. Streamlined data extraction for enhanced investigative capabilities.
- Stars: 120 | Last Updated: 2026-06-09
- Category:
leak-osint - Description: Tool for OSINT forensic analysis, search and graphing of communications content such as email MBOX files and CSV text message data using Elasticsearch and Kibana
- Stars: 86 | Last Updated: 2026-06-12
- Category:
leak-osint - Description: Finds as much OSINT data as possible using email address as a search term.
- Stars: 76 | Last Updated: 2026-06-02
A monumental expansion into non-traditional OSINT domains including satellite telemetry, multi-agent AI swarms, cryptocurrency flow tracing, and elite asset tracking (flights/yachts).
- Category:
crypto-blockchain-intel - Description: Deanonymize anyone based on their public commenting or posting history & pattern.
- Stars: 282 | Last Updated: 2026-06-15
- Category:
crypto-blockchain-intel - Description: 🔎 OSINT Maltego Transforms for investigating Telegram channels, groups, and users, including deanonymization via stickers, forwarded messages, similar channels, deleted posts, and more.
- Stars: 466 | Last Updated: 2026-06-14
- Category:
crypto-blockchain-intel - Description: Instagram-probiv-osint
- Stars: 6 | Last Updated: 2026-05-22
- Category:
crypto-blockchain-intel - Description: A powerful IP logging and deanonymization tool with Telegram bot integration
- Stars: 8 | Last Updated: 2026-05-27
- Category:
elite-asset-tracking - Description: Real-time global OSINT & intelligence dashboard — 3D globe visualization, multi-domain threat feeds, AI analysis, flight/vessel/satellite tracking. Built with Electron + React + CesiumJS.
- Stars: 13 | Last Updated: 2026-06-15
- Category:
elite-asset-tracking - Description: Real-time Middle East & Global Conflict Intelligence Dashboard OSINT aggregation, flight tracking, war ops monitoring, missile defense mapping, interactive tactical map. Built with .NET 8 WPF + WebView2 + Leaflet.js
- Stars: 6 | Last Updated: 2026-05-11
- Category:
elite-asset-tracking - Description: Real-time OSINT situational awareness platform — global threat events, submarine cables, oil/gas pipelines, military bases, live flights, ship tracking, CCTV feeds, country instability index, and intel dossiers on an interactive 3D globe
- Stars: 11 | Last Updated: 2026-06-13
- Category:
elite-asset-tracking - Description: Flight Tracker: Real-time flight updates and interactive map for seamless tracking and staying in the loop.
- Stars: 23 | Last Updated: 2026-02-12
- Category:
space-atmospheric-osint - Description: Real-time multi-domain OSINT dashboard — fork of BigBodyCobain/Shadowbroker with expanded global military bases, satellite coverage fixes, and financial data improvements
- Stars: 43 | Last Updated: 2026-05-31
- Category:
space-atmospheric-osint - Description: SpaceRecon is an Open-Source Intelligence (OSINT) tool for satellite reconnaissance, built with Golang. The tool can retrieve and parse TLE (Two-Line Element) data, and get the latest satellite conjunctions.
- Stars: 3 | Last Updated: 2024-09-02
- Category:
space-atmospheric-osint - Description: A simple space OSINT tool to retrieve Starlink satellite data 🛰️
- Stars: 12 | Last Updated: 2026-04-17
- Category:
adversarial-hacker-tools - Description: 🛡️ Detect and respond to security threats in real-time with God-Eye, an AI-driven tool designed for privacy and local deployment on multiple platforms.
- Stars: 39 | Last Updated: 2026-06-15
- Category:
adversarial-hacker-tools - Description: Go CLI and Library for quickly mapping organization network ranges using ASN information.
- Stars: 1059 | Last Updated: 2026-06-15
- Category:
ai-agent-swarms - Description: Tauri 2 desktop intelligence platform — Cesium.js 3D globe, 185 live panels, MCP server for Claude Code, and an explainable algorithm intelligence layer (truth scoring, evidence graph, compound risk, forecast calibration) plus shortage / weather / insights engines. 600+ deterministic tests.
- Stars: 5 | Last Updated: 2026-06-15
- Category:
ai-agent-swarms - Description: 🚢 Access maritime intelligence easily with Equasis CLI, a command-line tool for querying vessel data and analyzing fleets efficiently.
- Stars: 4 | Last Updated: 2026-06-15
- Category:
vibe-coded-systems - Description: Marie Landry's Spy Shop
- Stars: 1 | Last Updated: 2026-05-23
- Category:
vibe-coded-systems - Description: ⚔️ Ethical OSINT tool for recon, AI chat, and data footprinting — made for bug hunters, devs, and cyber warriors
- Stars: 1 | Last Updated: 2025-06-30
The bleeding edge of OSINT, focusing on darknet resiliency, multi-agent intelligence swarms, and AI-generated investigative prototypes.
whitakerunsaturated400/osint-feed - Autonomous Triage
- Description: Harvest RSS and HTML news sources in Node.js, deduplicate articles, and build compact digests for LLM context windows
- Stars: 6 | Last Updated: 2026-06-15
skyplon/Prospect-IQ - Vibe Coded Prototypes
- Description: AI-powered sales intelligence tool for Enterprise SDRs. Aggregates prospect signals across financial reports, LinkedIn activity, and tech stack data — generating personalized, brand-compliant outreach emails in under 5 minutes. Built as a vibe coding MVP prototype using Replit Agent.
- Stars: 1 | Last Updated: 2026-05-29
iamAgbaCoder/GitSage - Vibe Coded Prototypes
- Description: GitSage is an AI-powered Git intelligence tool that automatically generates high-quality commit messages from your staged changes — and explains them in plain English. Built for developers across all stacks, it analyzes your Git diff, understands your code changes, and produces:
- Stars: 1 | Last Updated: 2026-04-17
zorenhelal2-maker/DIGNITY_AI - Vibe Coded Prototypes
- Description: “Dignity AI is an advanced artificial intelligence platform that can create 3D models, generate code, and conduct sophisticated dialogues. Serving as a versatile AI assistant, it surpasses traditional boundaries, offering a powerful tool for both creative design and technical development.”
- Stars: 1 | Last Updated: 2026-04-16