CTI Expert

Cyber Threat Intelligence & OSINT Analysis Toolkit

Transform Claude into a trained intelligence analyst — 74+ commands, 49 techniques, zero API keys required for core functionality.

Installation  |  View Demo  |  Quick Start  |  Commands  |  Contribute

       

             

🇬🇧 English  ·  🇻🇳 Tiếng Việt  ·  🇨🇳 中文

_{Built by Hieu Ngo • hieu.ngo@chongluadao.vn • chongluadao.vn}

---

What is CTI Expert?

A Claude Code skill that transforms Claude into a trained cyber threat intelligence and open-source intelligence analyst. It runs structured intelligence collection using 74+ commands across 49 techniques — no API keys required for core functionality. To take full advantage, add your own free or paid API keys to the skill's .env — each is auto-detected and unlocks higher-tier access (e.g., Wigle, VirusTotal, URLScan.io, Shodan, Censys, SecurityTrails, WhoisXML).

Tip

Keyless by default, more powerful with your keys. Every core technique runs with zero API keys. Add any free or paid keys to .env (or run /apikeys set <service> <KEY>) and the skill auto-detects them, unlocking higher-tier pivots: reverse favicon→host, passive DNS, certificate search, sibling-domain discovery. A missing or bad key never breaks a run — it just degrades to a note. Setup guide: handbook/api-keys.md.

Tip

One skill, two layers. cti-expert is the broad collector — the wide net (/sweep, /webpivot, /subdomain, /username, /email-deep…). Built into the repo is a deep pipeline (intel_engine/) that turns raw collection into a real case: a persistent knowledge base, versioned cases, cross-case correlation, and calibrated assessment. The flow reads like a sentence — collect broadly → "seen this operator before?" → cluster → filter false positives → assess. No external setup: the backend resolves to SELF; install the deep-layer deps once with uv venv && uv pip install -r requirements.txt. Architecture: connectors/intel-backend.md.

Core Capability Multi-vector reconnaissance on any target type — person, domain, organization, username, email, IP, WiFi — with automated finding validation, exposure scoring, and structured intelligence delivery.

AEAD Workflow Acquire raw data → Enrich with pivot expansion → Assess findings → Deliver structured reports (interactive HTML + Markdown + JSON/CSV + IOC bundle; Word on request).

---

Demo

Full Case Investigation

CTI Report Generation

Screenshots

INTSUM Report	Network Topology	Risk Assessment

---

What's New in v2.6

Category	What's New	Details
/case runs unattended	Pivot loop defaults to autonomy=auto; the new recon commands auto-fire	The spider-map now expands to closure without approval prompts — the confidence gate, not a human prompt, is what keeps expansion tight (exact-match links auto-pursue, weak links held, dedup + depth caps unchanged). Depth summaries still print, so the run stays auditable. And the v2.6 recon commands are in the pipeline with no flags: /icp on every domain/URL/org target, /cn-corp on any company name or USCC found, /iban on any payment detail, /hash-id on every hash (before /hash) — and all three discovery-driven ones feed their yields back into the loop as new seeds. /redact stays opt-in (--redact): a redacted report is a weaker artifact, so producing one should be a deliberate call. Narrow with --checkpoint, --no-cn, --reach balanced|focused, --depth N
China / Sinophone recon	/icp + /cn-corp — the attribution layer Western registries can't reach	ICP filing (工信部备案) maps a domain to its registered PRC entity, and the licence serial reverse-pivots to every sibling site under the same filing — a same-operator link as strong as a shared GA ID. Then the registry chain: GSXT (ground truth) → TianYanCha/QCC/Aiqicha → 信用中国 blacklist → UBO, with USCC validation and revoked-status flags. Adds Quake (360) and ZoomEye as independent cyberspace indexes, a Baidu tier for /dork-sweep (tiers 1–4 index almost no CN content), and CJK variant generation — pinyin, Simplified↔Traditional and company-name stems — as a new /pivot-suggest axis. See techniques/china-recon.md
Fiat payment rails	/iban — bank accounts become selectors, like wallets already were	Most victims never touch crypto — they make a bank transfer. iban_analyze.py runs ISO 7064 mod-97 validation (proving a "bank account" on a payment page is fabricated without contacting anyone), decomposes the BBAN into bank/branch/account, and flags jurisdiction mismatch — the classic beneficiary-abroad mule pattern. Validated accounts export as financial/iban IOCs; invalid ones are recorded as behavioural findings. Covers VN/SEA non-IBAN rails too: VietQR/NAPAS BIN, card BIN, e-wallets, BIC. See techniques/fiat-payment-osint.md
Shareable reports	/redact — reversible PII redaction	redact.py replaces PII with stable numbered placeholders ([EMAIL_1] means one address across the whole case) and writes a reversible JSON map, so a report can leave the organisation and still be reconstituted for evidence. Handles .md/.json/.csv; round-trip is byte-exact. Infrastructure is not redacted by default — in a CTI report the actor's domains are the analysis, not incidental PII
Analytic rigor	Probability-anchored likelihood + 5W1H + ACH	Judgments now carry likelihood terms with probability bands (almost no chance → almost certain) reported alongside evidence confidence, because "MODERATE" alone means a 30-point-different thing to writer and reader. /coverage gains a 5W1H pass — a technique matrix measures effort, so a case could score 96% while answering no Why or How. /threat-model now requires an ACH matrix for attribution: rival hypotheses scored by inconsistency, runner-up named, and the evidence that would change the ranking stated. See handbook/analytic-standards.md
Hash typing	/hash-id — before any hash lookup	32 hex is MD5 or NTLM — one is a file hash, the other is credential material, and querying the wrong service returns a confident "unknown sample" that reads as exculpatory. Routes file hashes to MalwareBazaar/VT and credential hashes to /breach-deep, never a public cracking service

What's New in v2.5

What's New in v2.5

Category	What's New	Details
Recursive pivoting	/case is a spider-map — expands the whole network	/case now runs a recursive BFS pivot engine (pivot_orchestrator.py + engine/pivot-orchestration.md): every discovered identifier (email/domain/IP/username/wallet/…) becomes a new seed and the relationship graph expands hop-by-hop until the frontier is exhausted. Confidence-gated (exact-match links auto-pursue, weak/PII links held), cycle-safe (dedup + depth caps), with per-depth checkpoints. Defaults: active · exhaustive · checkpoint-per-depth
Archive IOC harvest	/webpivot --harvest — every selector the site ever exposed	wayback_harvest.py runs the full extractor over a domain's entire Wayback history, merging emails, phones, crypto wallets, tracking/verification IDs, SaaS-operator IDs and socials with first-seen/last-seen — recovering selectors a network later scrubbed. Emits case-schema indicators[] straight into the IOC bundle; auto-runs in /case for domain/URL targets. /webpivot now also extracts phone numbers (tel: + formatted) as ranked pivot leads
Archive access	Fetch archived pages Claude Code's WebFetch can't reach	WebFetch is blocked from web.archive.org (robots.txt at the fetch layer). wayback_fetch.py routes around it — CDX lookup → nearest-snapshot resolve → raw id_ fetch, with retry/backoff (--near, --list, --url-only, --json)
Web pivoting	/webpivot — map the infra behind a page	Favicon mmh3, GA/GTM/AdSense IDs, wallets & SaaS-operator tokens from a page's DOM → ranked pivots; same-operator correlation via /rank-relations (weighted scoring + noise denylist), /cert-pivot, /pivot-suggest, /crypto-balance, /email-hygiene, /sensitive-paths. Auto-runs in /case for domain/URL targets
Keyless by default	100% free — no key, no signup	crt.sh (certificate transparency) + passive DNS + anonymous urlscan always run; full pivoting at zero cost, nothing to configure
Premium auto-detect	Drop in a key → it upgrades itself	/webpivot auto-detects any premium key you've set (Shodan, Censys, FOFA, DNSLytics, SecurityTrails, urlscan-PRO, WhoisXML) and unlocks its higher tier — no flag, no re-run; a missing/bad key degrades to a note, never breaks the run. Manage keys with /apikeys
Attack surface	/appliance-scan — edge/VPN appliance → KEV mapping	Passive-first fingerprint of internet-facing Citrix/F5/Cisco/Ivanti/Forti/Palo Alto/Exchange appliances (Shodan InternetDB/Censys) → matched CISA KEV/CVE list; feeds /vuln-check + /threat-model
Identity fabric	/saas-map — SaaS tenancy + IdP surface	DNS-TXT tenancy tokens (Google/Atlassian/Zscaler/Salesforce/Workday…), non-Microsoft IdP fingerprint (Okta/Auth0/OneLogin/Ping/Keycloak/ADFS), unauthenticated API/GraphQL/OpenAPI-spec discovery
Credentials	Read-only liveness validation	A discovered key is confirmed live via identity-only endpoints (AWS STS, GitHub scopes, Slack auth.test, …/v1/models) — never a mutating call — upgrading it to CRITICAL with account/scope evidence
Integrity	Evidence-gated analysis	every asserted claim cites a resolvable finding; untrusted collected data is tagged, never executed
Recon	Native asn command	Keyless IP/ASN/domain lookups (ipwho.is + RDAP) on Windows; full nitefood/asn auto-installed on Linux/macOS/WSL
System tools	whois + dig + asn auto-install on Windows	winget Microsoft.Sysinternals.Whois + ISC.Bind; previously manual steps
Reliability	Windows PowerShell 5.1 hardening	Fixes native-stderr script aborts, the OSArchitecture probe crash, and maigret via uv tool --force; installs clean on WinPS 5.1
Packaging	Auto-PATH for CLI tools	~/.local/bin (uv tools + asn) added to PATH automatically — current session and persistent

What's New in v2.4

What's New in v2.4

Category	What's New	Details
Platform	Cross-platform OS detection (Windows/macOS/Linux)	OS-aware auto-install; self-healing DOCX (UTF-8 + auto-located pandoc)
Packaging	uv-first toolchain	uv venv / uv pip / uv tool; PEP 723 uv run zero-setup scripts; pip/pipx/venv fallback
Portability	Cross-agent support	Runs in Claude Code and OpenAI Codex via AGENTS.md + a ready-to-copy /cti-expert Codex prompt
CTI	Infostealer-log analyzer (/stealer-log)	Family ID, victim-vs-operator profiling, cross-log actor correlation, IOC + raw-artifact extraction
Recon	Admin / sensitive-endpoint detection	Subdomain-prefix + path + CJK classifier (admin, adm, kef, ador, panel…)
Collection	agent-browser integration	Primary interactive browser (vercel-labs): CDP, accessibility-tree snapshots, screenshots; complementary to Scrapling, no API key for core
Reliability	Fresh-VPS install hardening + CI	root/sudo + prereq bootstrap; smoke test + GitHub Actions on a minimal root Ubuntu container

What's New in v2.3

What's New in v2.3

Category	What's New	Details
WHOIS	Universal WHOIS for all TLDs	whoisdomain + CLI + Whoxy API; .vn, .th, .sg, .kr, 27+ ccTLD servers
WHOIS	Reverse & historical WHOIS (free)	Whoxy reverse API, historical lookup, ViewDNS
Web Collection	Scrapling adaptive scraping	3-tier: static → anti-bot → JS rendering; headless auto-open
Web Collection	Headless browser auto-open default	JS-heavy sites auto-detected and rendered via DynamicFetcher
Orchestration	AgentFlow parallel enrichment	DAG-based parallel pivot expansion for 3+ subjects
Performance	HTML parsing ~2ms	Scrapling parser replaces slow HTTP scraping
Platform	Python 3.10+ minimum	Required by Scrapling and AgentFlow

What's New in v2.2

What's New in v2.2

Category	What's New	Details
Image Forensics	Face search, reverse image, manipulation detection, AI geolocation	FaceCheck.id, TinEye, FotoForensics, Forensically, picarta.ai, GeoSpy, Pic2Map
Blockchain	Crypto wallet tracing, transaction graphs, scam detection	Blockchair, Etherscan, WalletExplorer, OXT.me, Chainabuse, Breadcrumbs
Transport	Aircraft tracking (unfiltered), vessel AIS, vehicle VIN lookup	ADS-B Exchange, Flightradar24, Marine Traffic, VesselFinder, NICB VINCheck
Darknet	Tor search, ransomware monitoring, onion service discovery	Ahmia.fi, onionsearch, DarknetLive, ransomwatch
Social Media	Reddit, Instagram, TikTok, Telegram investigation	Osintgram, instaloader, toutatis, RedditMetis, TGStat, TelegramDB, Bellingcat TikTok Timestamp
People Search	US people search engines, free reverse lookups	TruePeopleSearch, FastPeopleSearch, IDCrawl, That's Them
Mega-Dorks	11 cross-platform Google dork templates covering 73 unique domains	Social, Telegram ecosystem, dev platforms, forums, paste sites, darknet, breach DBs, business, image, messaging, jobs
IoT	Webcam directories, IoT device search	Insecam, Thingful

What's New in v2.1

Category	New Commands	What It Does
Intelligence	/render threat-path, /render attack-surface	Attack path flow + infrastructure exposure visualization
Intelligence	/snapshots, /diff	Wayback Machine snapshots and version diffing
Intelligence	/drift, /report ioc	Temporal risk tracking + IOC export (STIX 2.1)
UX	/onboard, /clarify, /quality	First-time tutorial, finding explanation, quality scoring
UX	/blind-spots, /source-check	Gap analysis + batch URL verification
UX	/workspace diff	Compare two saved investigation sessions
Data Model	Source Reliability A-F	Complements trust scores with source-level grading
Data Model	4 new entity types	Device, Image, Crypto Address, Custom
Data Model	HIGH conflict severity	4-level severity: CRITICAL/HIGH/NOTABLE/MINOR

---

Installation

Recommended: Use Claude Code CLI — it gives you the full terminal workflow, persistent sessions, and direct skill invocation. Download here or run npm install -g @anthropic-ai/claude-code.

Why Claude Code CLI?

The entire CTI Expert workflow is optimized for Claude Code CLI. The CLI gives you:

• Persistent sessions — investigations survive terminal restarts via /workspace save
• Full tool access — file writes, Python scripts, DOCX generation, all run natively
• Skill invocation — type /cti-expert directly in the terminal, no browser required
• Background agents — parallel enrichment via AgentFlow works best with the CLI

🖥️ Where to run it — the CLI is best for this skill

Important

CTI Expert is execution-heavy: it runs uv/Python, installs OSINT tools, writes .md/.html/.json/.csv reports + IOC bundles, reaches many external sites, and saves case workspaces. What matters is a real local shell + persistent files + open network — a CLI or local desktop agent gives you that; an ephemeral cloud sandbox does not. This applies equally to Claude and Codex.

Environment	Running cases	Why
Claude Code CLI · Codex CLI	✅ Best	Real shell, persistence, background tasks, open network — what the skill is built for
Claude Code Desktop · Codex IDE extension	✅ Great	Same local execution; nicest for reading rendered reports, charts & diagrams
claude.ai/code (web) · Codex cloud / ChatGPT web	⚠️ Limited	Reasoning & query generation work, but files don't persist to your disk and outbound network is often restricted

Tip

Run investigations in a CLI (Claude Code or Codex); open the generated .docx/report in a Desktop/IDE window if you prefer reading there. Use web/cloud surfaces only for analyst-reasoning, not execution-heavy recon.

---

Step 1 — Install Claude Code CLI

npm install -g @anthropic-ai/claude-code

Requires Node.js 18+. Full docs: docs.anthropic.com/en/docs/claude-code/overview

---

Step 2 — Clone + All-in-One Installer

The installer handles everything: Python dependencies, system tools (whois, dig, asn, jq, exiftool), OSINT tools (maigret, sherlock, holehe, h8mail, and more), and optional headless browser + Go tools. It is powered by uv (Astral's ultra-fast Rust package manager) — the script bootstraps uv, then uses uv venv / uv pip / uv tool for all Python installs, falling back to pip/pipx/venv only if uv can't be installed. Use install.ps1 on Windows (PowerShell) or install.sh on macOS/Linux/Git Bash/WSL.

Platform	Command
Linux / macOS	git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert bash ~/.claude/skills/cti-expert/scripts/install.sh
Windows (Git Bash or WSL)	git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert bash ~/.claude/skills/cti-expert/scripts/install.sh
Windows (PowerShell — native)	git clone https://github.com/7onez/cti-expert.git "$env:USERPROFILE\.claude\skills\cti-expert" powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.claude\skills\cti-expert\scripts\install.ps1"

Windows users: install.ps1 is a full native installer (winget system tools + Python venv + OSINT tools) — no Git Bash or WSL required. It accepts the same -Headless, -Go, and -All flags (e.g. install.ps1 -All). Git Bash / WSL users can run install.sh instead. The DOCX generator self-heals UTF-8 output and auto-locates pandoc, so reports build on Windows with no extra environment setup. The skill itself detects the OS at runtime and installs any missing tool with the right manager (winget / brew / apt) — see scripts/platform-setup.md.

---

Installer Options

macOS / Linux / Git Bash / WSL:

bash scripts/install.sh               # Core: Python deps + system tools + OSINT tools
bash scripts/install.sh --headless    # + Scrapling headless browser (~200MB Chromium)
bash scripts/install.sh --go          # + Go tools (subfinder, amass, gau, gitleaks, httpx)
bash scripts/install.sh --all         # + Everything above

Windows (PowerShell):

powershell -ExecutionPolicy Bypass -File scripts\install.ps1              # Core
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Headless    # + Scrapling headless browser
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Go          # + Go tools
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -All         # + Everything above

Flag	What it installs	Size
(none)	Python packages, whois, dig, asn, jq, exiftool, maigret, sherlock, holehe, h8mail, theHarvester, waymore, xeuledoc, agentflow	~50 MB
--headless	Scrapling StealthyFetcher + DynamicFetcher + Chromium	+200 MB
--go	subfinder, amass, gau, gitleaks, httpx, trufflehog, phoneinfoga	+150 MB
--all	Everything	~400 MB

---

Step 3 — Register the commands with Claude Code

install.sh installs the OSINT tools. This one-time step wires the skill, the 8 /cti* slash commands, and the MCP tools into Claude Code so they work from a cold prompt in any project — it symlinks commands/*.md into ~/.claude/commands/ and writes the per-machine .mcp.json. It's idempotent, so it's safe to re-run after a git pull.

# Register the skill + 8 commands + write the per-machine .mcp.json
bash ~/.claude/skills/cti-expert/scripts/register.sh

# Recommended: install the built-in deep-pipeline (intel_engine) deps once
cd ~/.claude/skills/cti-expert && uv venv && uv pip install -r requirements.txt

Windows (native PowerShell): run register.sh from Git Bash or WSL — it uses symlinks. Then, on every platform, restart Claude Code so the skill and commands load at startup.

---

Verify Installation

claude              # open Claude Code CLI, then type:
/cti-status         # health check — backend tier, MCP tools, API-credit balances
/cti example.com    # …or just start investigating

/cti-status confirms the backend, MCP tools, and API-credit balances in one shot. If the /cti* commands aren't recognized, re-run Step 3 (register.sh) and restart Claude Code. You can also type /cti-expert to load the skill directly, then describe your goal in plain English.

---

Use in ChatGPT / Codex (cross-agent)

CTI Expert is portable: the analyst logic is plain Markdown and the scripts are OS-detecting Python/shell, so it runs in OpenAI Codex (and other AGENTS.md-aware agents), not just Claude Code.

# 1. Clone the skill anywhere
git clone https://github.com/7onez/cti-expert.git

# 2a. In-repo: open Codex inside the clone — it auto-loads AGENTS.md. Then ask it to follow SKILL.md.
# 2b. Slash command: copy the bundled Codex prompt so /cti-expert works in the Codex CLI/IDE
cp cti-expert/codex/cti-expert.md ~/.codex/prompts/cti-expert.md   # Windows: copy to %USERPROFILE%\.codex\prompts\

• AGENTS.md is the cross-agent runtime contract (OS detection, uv, paths). Codex auto-concatenates it from the repo root; you can also reference it from ~/.codex/AGENTS.md.
• codex/cti-expert.md is a ready-to-copy custom prompt → gives Codex a /cti-expert <target> slash command.
• Plain ChatGPT (no code execution): the reasoning, query generation, and report drafting all work (load SKILL.md/AGENTS.md as instructions or Custom-GPT knowledge); only local steps (DOCX build, CLI tool runs) need a code-capable harness like Codex or Claude Code.

Paths are resolved relative to the skill directory (the folder containing SKILL.md), so nothing assumes the Claude-specific ~/.claude/skills/ location.

---

Alternative — Claude Code Desktop (macOS / Windows)

Download: claude.ai/download — available for macOS and Windows

Step-by-step (no terminal needed):

1. Install Claude Code Desktop — Download from claude.ai/download and install the app

2. Download CTI Expert — Go to the GitHub repository, click the green "Code" button, then select "Download ZIP"

3. Extract to your skills folder — Unzip the downloaded file, then move the extracted folder to your skills directory and rename it to cti-expert:

   Platform	How to navigate
   macOS	Open Finder → Press Shift + Cmd + G → Type ~/.claude/skills/ → Press Go → Move the folder here
   Windows	Open File Explorer → Type %USERPROFILE%\.claude\skills\ in the address bar → Press Enter → Move the folder here

   Note: If the skills folder does not exist, create it inside the .claude folder first.

4. Run the installer + register — Open the Claude Code Desktop terminal and run:

   bash ~/.claude/skills/cti-expert/scripts/install.sh      # OSINT tools
   bash ~/.claude/skills/cti-expert/scripts/register.sh     # skill + 8 commands + MCP

   Or on Windows PowerShell (Python deps only; run register.sh from Git Bash/WSL):

   pip3 install -r "$env:USERPROFILE\.claude\skills\cti-expert\scripts\requirements.txt"

5. Restart Claude Code Desktop — Close and reopen the app

6. Verify — Type /cti-status in the chat to confirm the skill and commands loaded (or /cti-expert to load the skill directly)

System Requirements

Requirement	Version	Purpose
Claude Code CLI	Latest	Recommended terminal runtime
Claude Code Desktop	Latest	GUI runtime (macOS/Windows)
Node.js	18+	Required by Claude Code CLI
uv	Latest	Recommended — bootstrapped by the installer; manages Python, venv, packages & CLI tools
Python	3.10+	DOCX report generation, Scrapling, AgentFlow (uv can install this for you)
pip packages	See requirements.txt	Charts, diagrams, styling
git	Any	Clone the repository

---

Quick Start

How commands work — read this first

There is one command to remember: /cti <target>. It looks at what you gave it — a domain, IP, email, username, phone, wallet, hash, or APK — and runs the right chain automatically. That's usually all you need.

Under it sit 8 registered commands that Claude Code recognizes from a cold prompt in any project (no need to load the skill first):

Command	What it does
/cti <target>	Entry point — routes by target type and runs the whole chain
/cti-recall <seed>	"Have I seen this before?" — check against every prior case. Run this first.
/cti-case <ID> <seeds>	Full deterministic pipeline: collect → ingest → cluster → assess
/cti-pivot <url|ip>	Collect pivot artifacts from one target
/cti-cluster <domain>	Expand & correlate an existing case
/cti-check <indicator>	False-positive control — real operator link, or shared noise?
/cti-report <ID>	Render the relationship graph + a polished PDF/DOCX
/cti-status	Health check — backend, MCP tools, API-credit balances

Every other command on this page (/case, /webpivot, /report, /sweep…) is a convention command: shorthand that works once the skill is loaded — via /cti, or by typing /cti-expert to open the skill directly. At a cold prompt, reach for a registered command above, or just describe your goal in plain English — it works identically.

1 — Investigate anything

/cti example.com          # domain  → full pipeline
/cti user@domain.com      # email   → breach + infrastructure + cross-platform
/cti @username            # handle  → 3000+ platform enumeration, then pivot
/cti 185.1.1.1            # IP      → ASN, co-tenancy, open ports, passive DNS
/cti ./trader.apk         # file    → static IOCs, clustered with the web infra

/cti picks the right techniques for the target, then expands the pivot graph to closure — no approval prompts. Add --deep for parallel sub-agent fan-out, --quick for a single pass, or --passive for hostile targets (no live contact). Default output: Markdown + interactive HTML + JSON + CSV + IOC bundle.

2 — Run a case end-to-end

/cti-recall example.com               # always first — have we seen this seed before?
/cti-case CASE-0001 example.com       # full pipeline on one or more seeds
/cti-cluster CASE-0001                # expand: peers, shared indicators, TLS overlap
/cti-report CASE-0001 --pdf           # deliver: relationship graph + PDF/DOCX

3 — Guided Flows

The commands below are convention commands — type them once the skill is loaded.

/flow person           # Person investigation workflow
/flow domain           # Domain reconnaissance workflow
/flow image            # Image verification workflow

4 — Targeted Reconnaissance

/sweep @username                    # Multi-vector recon on handle
/query example.com                  # 12-15 advanced search queries
/username johndoe                   # Platform enumeration (3000+)
/email-deep user@domain.com         # Deep email investigation
/subdomain example.com              # Certificate transparency + brute-force
/github-osint github.com/org/repo   # GitHub profiles, repos, code, commits, forks
/threat-check 185.1.1.1             # IP/domain/URL threat intelligence
/scam-check suspicious-site.xyz     # Phishing/scam domain check
/breach-deep user@domain.com        # Multi-source breach lookup

5 — Analysis & Assessment

/exposure domain.com                # Composite risk score (0-100)
/threat-model                       # Build threat model from findings
/validate                           # Verify all findings
/coverage                           # Check investigation completeness

6 — Reporting

/report                             # Technical INTSUM report
/report brief                       # Executive summary
/brief                              # Plain-language summary
/workspace save                     # Save case workspace state (resume later)

---

Best Practices

Habits that keep investigations fast, cheap, and correct — most are enforced by the skill itself, but knowing them helps.

Running a case

• Start with /cti <target>. It's the single entry point and routes by target type (domain, IP, email, username, phone, wallet, hash, APK). Don't hand-run collectors.
• Recall before you collect. /cti-recall <seed> (or Step 0 of /cti) is the cheapest call in the toolkit — it tells you if a seed is already attributed, saving credits and avoiding contradicting a prior assessment.
• --passive for anything hostile. The egress gate refuses a direct fetch of hostile infrastructure; passive mode works from Wayback/urlscan captures, so your IP never touches it.
• Screen indicators before clustering. /cti-check <indicator> (false-positive control) — a false merge names an innocent party; a false split loses the case.
• --deep earns its cost at 3+ live seeds (parallel sub-agent fan-out); a single seed runs inline.
• /cti-status when something behaves oddly — backend tier, MCP tools, and API balances in one shot.

Cost & keys

• Two separate ledgers: model reasoning (/cost) vs third-party API credits (api_usage) — never the same number.
• Keyless by default; /apikeys upgrades. Keys enrich pivots (Shodan/Censys/FOFA/…) but nothing requires them.

If you're developing the skill

• bash scripts/install-hooks.sh once per clone — wires the leak check as a pre-commit hook.
• bash scripts/audit.sh before pushing — the drift/leak/test gate (also runs in CI on every PR).
• A classification change ships with its test (RULE 5).

---

Features

Identity & People Person lookup — 50+ data points Phone — carrier, reputation, associations Email — accounts, breaches, infrastructure Username — 3000+ platform enumeration GitHub developer footprint — profiles, orgs, repos, commits, forks	Domain & Infrastructure Subdomain enumeration via CT logs CMS, CDN, analytics fingerprinting DNS forensics & WHOIS deep/reverse Traffic analysis & audience demographics ICP filing → PRC entity + sibling-domain pivot IBAN/bank-account validation & attribution	Analysis & Verification Face search (FaceCheck.id) & reverse image (TinEye) Image forensics (FotoForensics, Forensically) AI photo geolocation (picarta.ai, GeoSpy) Document/email metadata forensics Google Docs identity extraction 100+ paste sites & breach DBs Likelihood-banded judgments, 5W1H coverage, ACH
WiFi, Geo & Transport SSID/BSSID lookup via Wigle.net W3W, Plus Codes, MGRS, Street View Aircraft tracking (ADS-B Exchange, Flightradar24) Vessel tracking (Marine Traffic, VesselFinder) Vehicle VIN lookup & plate recognition	Security Auditing Cloud audit (AWS/GCP/Azure) OWASP Top 10 source code review CVE & supply chain vulnerability checks LLM/agent/MCP prompt injection audit	Reporting & Export INTSUM, executive brief, plain-language DOCX with charts, diagrams, timelines Save/load case workspaces Legal, journalist, HR, threat analyst formats Reversible PII redaction for external sharing

---

AEAD Case Lifecycle

Every investigation follows four automated phases:

                         ╭──────────────────────────────────────╮
                         │         AEAD CASE LIFECYCLE          │
                         ╰──────────────────────────────────────╯

   ┌─── ACQUIRE ────────────────────────────────────────────────────────┐
   │  Collect raw data via /sweep, /query, /username, /phone, etc.     │
   │  Database search, enumeration, collection gap logging             │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ENRICH ─────────────────────────────────────────────────────────┐
   │  Expand leads via /branch, /crossref, /link-subjects, /signatures │
   │  Shared identifier detection, relationship mapping                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ASSESS ─────────────────────────────────────────────────────────┐
   │  Score & verify via /exposure, /threat-model, /validate, /coverage│
   │  Risk scoring, completeness check, evidence chains                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── DELIVER ────────────────────────────────────────────────────────┐
   │  Package output via /report, /brief, /render, /workspace save     │
   │  Auto-saves .md, .html, .json, .csv + IOC set                     │
   └────────────────────────────────────────────────────────────────────┘

Run /progress at any point to see current phase and pending tasks.

Workflow diagrams

Full /case pipeline (AEAD) — where /webpivot, correlation, and premium keys fit:

/webpivot + correlation + premium API-key flow:

_{Sources: workflow-case.puml · workflow-apikeys.puml — see the API-keys & webpivot guide.}

---

Command Reference

The tables below are convention commands — the full technique vocabulary, available once the skill is loaded (via /cti or /cti-expert). The 8 registered entry commands (/cti, /cti-recall, /cti-case…) are in Quick Start above. For the authoritative reference, see SKILL.md.

Acquire — Data collection commands

Command	Purpose
/case [target]	Full pipeline — every applicable technique
/sweep [target]	Multi-vector recon (person/domain/org/username/email/IP)
/query [subject]	12-15 advanced search operator queries
/username [handle]	3000+ platform enumeration
/phone [number]	Carrier lookup, reputation, associations
/email-deep [email]	Accounts, breaches, infrastructure
/subdomain [domain]	CT logs + passive enumeration
/github-osint [target]	GitHub user/org/repo profiles, code, commits, forks
/threat-check [target]	IP/domain/URL/hash threat intelligence
/breach-deep [email]	Multi-source breach lookup

Enrich — Lateral expansion commands

Command	Purpose
/branch [data]	Lateral expansion (email→username, username→email, etc.)
/crossref	Shared identifier detection across subjects
/link-subjects [A] [B]	Define connection between subjects
/show-connections	Display logged connections
/graph	Full ASCII subject relationship map

Assess — Scoring & verification commands

Command	Purpose
/exposure [target]	Composite risk score (0-100)
/threat-model	Build threat model from findings
/validate	Verify finding evidence chains
/coverage	Check investigation completeness

Deliver — Report generation commands

Command	Purpose
/report	Technical INTSUM report
/report brief	Executive summary
/brief	Plain-language summary
/workspace save	Persist case workspace state (resume later)

Web-Infra Pivoting & Correlation — infrastructure & same-operator analysis

Command	Purpose
/webpivot [url]	Extract favicon/tracker/wallet/SaaS-operator artifacts → ranked pivot queries (Shodan/FOFA/urlscan). Flags: --rank, --cert, --graph, --history, --whois
/rank-relations	Score + rank same-operator relations across pages (weighted signals, noise-filtered, clustered)
/cert-pivot [domain]	Find other hosts serving the same TLS cert + SAN siblings (keyless; Shodan/Censys with keys)
/pivot-suggest	Rank "what to pivot next" from findings (leet/variant/temporal/domain clusters, CJK pinyin + Traditional + company-stem)
/crypto-balance [addr]	On-chain balance + lifetime flow for a wallet, valued at spot
/iban [value]	Validate + decompose a bank account (mod-97, BBAN split, bank code, mule signals)
/email-hygiene [email]	Grade an email domain 0-100 + A-F (disposable/MX/free/role)
/sensitive-paths [list]	Classify a Wayback/URL list for exposed paths (.git/.env/backups/configs)

China / Sinophone Recon — ICP filings, PRC registries, CN indexes

Command	Purpose
/icp [domain|serial]	ICP filing → registered PRC entity + licence no.; reverse the licence serial to sibling domains under one filing
/cn-corp [name|USCC]	GSXT → TianYanCha/QCC/Aiqicha → 信用中国 chain: officers, shareholders, subsidiaries, UBO, revoked-status flags
/dork-sweep [t] --baidu	Baidu tier — tiers 1–4 (Google/Bing/DDG) index almost no CN-hosted content
/pivot-suggest --cjk	Pinyin, Simplified↔Traditional and company-name-stem variants

Registries needing mainland egress (TianYanCha/QCC/Aiqicha) are logged as collection gaps, never blockers.

Reporting Hygiene

Command	Purpose
/redact [file]	Shareable report variant — stable [EMAIL_1] placeholders + reversible JSON map (.md/.json/.csv). Opt-in; the default export set stays unredacted
/hash-id [hash]	Identify a hash's algorithm before lookup — file hash vs credential material

Deep Pipeline & Knowledge Base — built-in (vendored intel_engine)

Built into the skill under intel_engine/ (intel_engine/harness/, tools/, knowledge/, cases/). /backend resolves to SELF — no setup. Install the deep-layer deps once: uv venv && uv pip install -r requirements.txt. See connectors/intel-backend.md.

Command	Purpose
/backend	Detect the backend and report the tier — Tier 1 (typed MCP) → Tier 2 (CLI) → Tier 3 (stateless). /backend check shows the full resolution trail
/kb [query]	Query the shared knowledge base — stats, entity/cluster/shared-indicator lookup, confirmed-operator ledger
/recall [seed]	"Have I seen this before?" — check a seed against every prior case before collecting
/risk [case]	Score a case's hosts for NRD / bulletproof-hosting / money-trail red flags
/reverse-whois [email|name]	Reverse-WHOIS a registrant → high-value pivots only (privacy/bulk filtered)
/cert-overlap [d1 d2 …]	KB-aware TLS/SAN same-operator verdict across domains
/reference [check|add|list]	False-positive control ledger — BENIGN vs SIGNAL fingerprints
/harness [open|continue|status]	Whole-case orchestration — persistent, versioned, cross-case to convergence
/graph --render	IntelGraph publication-quality case-graph render → PNG/SVG
/report pdf	IntelReport pandoc render of an assessment → polished PDF/DOCX
/binary [file|url]	Static IOC extraction from a scam APK/exe (signing cert, package, C2 hosts, wallets) → clusters with web infra

All backend commands dispatch through scripts/backend/intel.py at Tier 2 (or the typed MCP tool at Tier 1); absent → they degrade to a note.

---

Skill Tiers

Output density and automation adapt to your proficiency. Switch tiers any time — the output changes immediately: /novice enters Novice, /novice off gives you Specialist, and Practitioner is the default in between.

Novice	Practitioner	Specialist
Low-jargon mode, step-by-step guidance, pre-built templates for due diligence, background checks, security reviews. Switch: /novice Try: /flow person, /flow domain, /template list	Advanced search operators, manual pivot expansion, custom threat modeling, guided flows with explanation. Switch: default — no command Try: /query [target], /branch [data], /crossref, /threat-model	Raw technique access, custom evidence weighting, CONTESTED finding resolution, direct database queries. Switch: /novice off Try: /username [handle], /email-deep [email], /secrets [target], /threat-check [target]

---

Technique Catalog

49 techniques — click to expand full catalog

Technique	Coverage	API Key Required?
fx-metadata-parsing.md	EXIF, email headers, document forensics	No
fx-image-verification.md	Image authenticity, provenance, reverse search	No
fx-breach-discovery.md	Breach database + paste site enumeration	Optional (HIBP bulk, DeHashed paid)
fx-http-fingerprint.md	HTTP signature analysis, server fingerprinting	No
fx-leak-monitoring.md	Leak and breach monitoring automation	Mixed (IntelligenceX/Shodan paid)
fx-dns-cert-history.md	Historical DNS + SSL/TLS certificate timeline	No
fx-document-forensics.md	PDF/Office authorship, creation chain, hidden content	No
fx-network-mapping.md	Network topology, entity graph construction	No
username-osint.md	3000+ platform enumeration	No
phone-osint.md	Carrier lookup, VoIP, FreeCNAM, WhoCalld	No
email-osint.md	Deep email investigation, breach history	No
threat-intel.md	GreyNoise, AbuseIPDB, OTX, VirusTotal, CIRCL CVE, NVD	Optional (VT/URLScan free keys)
web-traffic-analysis.md	SimilarWeb, Semrush estimation	No
domain-advanced.md	CT logs, Amass, Subfinder, passive enum	No
social-media-platforms.md	Twitter/X, Discord, Strava, BlueSky, ShareTrace, Reddit, Instagram, TikTok, Telegram	Partial (Discord needs token)
image-forensics-and-face-search.md	FaceCheck.id, TinEye, FotoForensics, Forensically, picarta.ai, GeoSpy, Pic2Map	No
blockchain-investigation.md	Blockchair, Etherscan, WalletExplorer, OXT.me, Chainabuse, Breadcrumbs	Optional (Etherscan API for bulk)
fiat-payment-osint.md	IBAN mod-97 + BBAN decomposition, BIC, VietQR/NAPAS BIN, card BIN, account-reuse pivot	No
china-recon.md	ICP filings, GSXT/信用中国/TianYanCha/QCC/Aiqicha, USCC, Quake/ZoomEye/FOFA, Baidu dorking, CJK variants	Partial (CN indexes need free keys; aggregators need CN egress)
transport-tracking.md	ADS-B Exchange, Flightradar24, Marine Traffic, VesselFinder, VIN decode	No
darknet-investigation.md	Ahmia.fi, onionsearch, DarknetLive, ransomwatch	No
advanced-geolocation-techniques.md	W3W, Plus Codes, MGRS, Overpass Turbo	No
wifi-ssid-osint.md	Wigle.net SSID/BSSID geolocation	Free account (Wigle API)
web-dns-forensics.md	Zone transfers, GitHub, Telegram, WHOIS	Optional (WHOIS API)
scam-check.md	Phishing/scam domain verification	No
ioc-export.md	IOC export (STIX 2.1, flat list)	No
cloud-audit.md	AWS/GCP/Azure IAM, network, compute audit	No
dependency-audit.md	CVE, supply chain, CI/CD security	No
disk-forensics.md	Sleuth Kit, file carving, artifact recovery	No
incident-triage.md	NIST 800-61, containment, IOC extraction	No
owasp-audit.md	OWASP Top 10 source code review	No
prompt-injection-audit.md	LLM/agent/MCP security assessment	No
fx-visitor-intelligence.md	Visitor stats, tech stack, geo analysis	No
fx-social-topology.md	Social graph construction and analysis	No
fx-geolocation.md	GPS, W3W, Plus Codes, MGRS, Street View	No
secret-scanning.md	Credential/secret detection in code	Optional (GitHub token for GitDorker)
github-osint.md	GitHub profile, org, repo, code, commit, fork, and collaboration recon	Optional (GitHub token for higher API limits)
fx-email-header-analysis.md	Email header analysis, SPF/DKIM	No
fx-edge-appliance-recon.md	Edge/VPN appliance fingerprint → CISA KEV/CVE catalog + port-risk matrix	No (Shodan/Censys optional)
fx-saas-identity-recon.md	SaaS tenancy (DNS-TXT) + IdP fingerprint + API/GraphQL/spec discovery	No
web-pivot.md	Web-infra pivoting — favicon mmh3, tracker/wallet/SaaS-operator artifacts → ranked pivots	Optional (premium keys upgrade tiers)
whois-universal.md	Universal multi-TLD WHOIS cascade — gTLD/ccTLD (.vn/.th/.sg/.kr), reverse & historical	Optional (Whoxy/WhoisXML for reverse/history)
web-collection-scrapling.md	Adaptive web scraping — static → anti-bot → JS rendering	No
agent-browser.md	Interactive browser collection — CDP, accessibility-tree snapshots, screenshot evidence	No (chat mode optional)
agentflow-enrichment.md	Parallel DAG enrichment orchestration for 3+ subjects	No
microsoft-tenant-recon.md	M365/Azure tenant recon — tenant ID, federation, MDI, SharePoint	No
stealer-log-analysis.md	Infostealer-log triage — family ID, victim-vs-operator profiling, cross-log correlation, IOC	No
fx-dork-sweep.md	Zero-auth dork sweep — Telegram ecosystem, doc-hosts, filetype families	No
fx-document-leak-hunt.md	18-platform document-leak hunt with severity classification	No

---

Report Formats

You never have to ask for output. Every /report, /brief, and /case writes the full set automatically — one interactive web page to explore the case, plus machine-readable files for tooling and evidence. Need to share a report outside your team? Add --redact and PII is swapped for stable placeholders (and can be reversed later).

🌐 Interactive HTML report — the one you'll actually read A single self-contained file — no internet, no server, opens in any browser. Dashboard — KPIs, an exposure gauge, and pie / bar / donut charts Entity graph — drag, zoom, and click any node to inspect it Infrastructure & timeline — topology map plus an interactive event history Indicators & Selectors — every IOC, contact, handle, and wallet, with actor ↔ victim attribution Navigation — global search, category menus, dark / light theme, print-to-PDF

📄 Markdown · JSON · CSV · IOC bundle — for tooling & evidence The same case, in formats other tools can read. Markdown — the written report: INTSUM, executive brief, plain-language, or legal JSON — structured case data to feed pipelines and other tools CSV — findings and indicators, ready for a spreadsheet or SIEM IOC bundle — STIX 2.1, flat list, and CSV of every selector Word (.docx) — on request, or /report legal (cover page, table of contents, charts)

Every report variant is one command — the five-format default set (.md · .html · .json · .csv · IOC bundle) saves automatically on every /report, /brief, and /case; the variants below pick a specific format or audience:

Command	Format	Best for
/report · /report html	Interactive HTML (default, primary deliverable)	Everyone — analysts to execs
/report	Technical INTSUM (Markdown)	Analysts, security teams
/report brief	Executive brief	Decision-makers, management
/brief	Plain-language summary	Non-technical stakeholders
/report legal	Legal evidence format (auto-adds DOCX/PDF)	Attorneys, compliance teams
/report journalist	Source-citation-heavy	Reporters, media
/report json · /report csv	JSON · CSV export	Pipelines, spreadsheets, SIEM
/report ioc	IOC / selector bundle (STIX 2.1 · flat · CSV)	SIEM / TIP ingest, threat-intel sharing
/report docx	Word document (charts, cover, TOC)	Formal sharing — on request
/cti-report <ID> --pdf	IntelReport pandoc PDF/DOCX	Polished, publication-grade case deliverable

_{Generated by scripts/generate-cti-html.py (HTML) · scripts/generate-cti-iocs.py (IOCs) · scripts/generate-cti-docx-hybrid.py (DOCX) · intel_engine/IntelReport (pandoc PDF/DOCX)}

---

Architecture

Project structure — click to expand

cti-expert is one skill, two layers — a broad collector plus a vendored, self-contained deep pipeline. STRUCTURE.md is the authoritative map.

cti-expert/
├── SKILL.md                    The single skill entrypoint — commands & tradecraft
├── README.md                   This file  ·  README.vi.md · README.zh-CN.md
├── STRUCTURE.md                Authoritative layout + anti-drift rules
├── AGENTS.md                   Cross-agent runtime contract (Claude Code + Codex)
├── CLAUDE.md                   Contributor rules (loads only when building the repo)
│
├── commands/                   8 registered slash commands — work from a cold prompt
│   ├── cti.md                  /cti — the entry point, routes by target type
│   ├── cti-recall.md · cti-case.md · cti-pivot.md · cti-cluster.md
│   └── cti-check.md · cti-report.md · cti-status.md
│
│  ── LAYER 1 · Broad collector — cti-expert's own tools ──────────────
├── scripts/                    Collectors, backend dispatcher, report generators
│   ├── backend/                backend.py (tier resolver) · intel.py (T2 CLI dispatch)
│   ├── webpivot/               pivot_extract · cert_pivot · wayback_* · rank_relations …
│   ├── generate-cti-html.py    Interactive, offline, self-contained HTML report
│   ├── generate-cti-iocs.py    IOC / selector export (STIX 2.1 · flat · CSV)
│   ├── generate-cti-docx-hybrid.py   DOCX report (charts, diagrams, cover page)
│   ├── iban_analyze.py · redact.py · stealer_log_parse.py · pivot_orchestrator.py
│   ├── install.sh · install.ps1      All-in-one cross-platform installer
│   └── audit.sh · leakcheck.sh · install-hooks.sh   Drift · leak · pre-commit gates
│
├── techniques/                 49 collection techniques (the OSINT tradecraft)
├── handbook/                   Pivot artifacts, API keys, operator queries, analytic standards
├── engine/                     Case data-model design docs (schema, findings, pivot logic)
├── analysis/ · validation/     Pattern & exposure engines · QA + coverage matrices
├── experience/                 UX — skill tiers, guided flows, case templates
├── workflows/ · guides/        Professional use-case guides · worked walkthroughs
├── connectors/                 intel-backend · Maltego · Notion · Obsidian export
├── tests/                      Zero-dep regression tests (RULE 5 classification + collect_core)
│
│  ── LAYER 2 · Deep pipeline — vendored, self-contained ──────────────
└── intel_engine/               Collect → Correlate → Assess pipeline + knowledge base
    ├── harness/                Pipeline brain — orchestrator.py · mcp_server.py · tools.py (18 @tool)
    ├── tools/                  intel.py (deterministic pipeline) · kb/ (KB + correlation) · cert_overlap
    ├── WebPivot/               Engine collector helpers + de-dup re-export shims
    ├── IntelGraph/             Publication-quality case-graph rendering (PNG/SVG)
    ├── IntelReport/            Pandoc render of an assessment → polished PDF/DOCX
    ├── IntelAnalysis/          Correlation, attribution, confidence calibration
    ├── BinaryPivot/            Static IOC extraction from a scam APK / exe
    └── knowledge/ · cases/     Local runtime data — gitignored, never committed

---

Professional Workflows

Workflow	Audience	File
Journalist Source Verification	Reporters, fact-checkers	workflows/wf-journalist.md
HR Screening	HR professionals, recruiters	workflows/wf-hr-screening.md
Cyber Threat Intelligence	Security analysts, IR teams	workflows/wf-threat-analyst.md
Private Investigator	Licensed PIs, legal teams	workflows/wf-private-investigator.md

Activate with /flow [type] for interactive guided prompts.

---

Ethics & Responsible Use

This skill is for lawful research and professional security investigation only.

Permitted	Prohibited
Journalist fact-checking & source verification HR background screening (with consent) Corporate security research & threat intelligence Authorized penetration testing & security audits Legal/compliance investigation Personal reputation monitoring (self-search)	Doxxing, harassment, or stalking Unauthorized surveillance Social engineering or fraud Privacy violations Criminal activity

You are responsible for all use of this skill. Comply with local laws, regulations, and platform terms of service. Always respect privacy and consent boundaries.

---

Contributing

We welcome research contributions, new techniques, and workflow improvements.

Contribution guidelines

Adding techniques:

1. Create techniques/fx-[name].md with method description, free tool lists, limitations

Workflow improvements:

1. Document in workflows/ with success criteria

Pull request process:

1. Fork and create feature branch: git checkout -b feature/technique-name
2. Document changes in SKILL.md and README.md
3. Test on at least 3 real-world targets
4. Submit PR with description

Bug reports: File issues with command output, environment, and target type.

---

License

MIT License + Ethical Use Addendum

You are free to use, modify, and distribute this skill under the MIT license, provided that you include original attribution, comply with the ethical use guidelines above, and clearly mark any derivatives.

See LICENSE for full text.

---

🙏 Acknowledgments & Credits

CTI Expert stands on the shoulders of the open-source community and free, public-interest data providers. A huge thank-you to every project, vendor, and free API below — this skill simply would not exist without your work. (Listing here does not imply affiliation or endorsement; always respect each provider's terms of service.)

Category	Projects & free services we're grateful to
Agents & runtime	Anthropic — Claude Code · OpenAI — Codex · Astral — uv · Python · Node.js · Rust
Browser & web collection	agent-browser — Vercel Labs · Scrapling · Chromium
Username, people & social	Maigret · Sherlock · Blackbird · instaloader · Osintgram · toutatis · ShareTrace
Email & breach data	Holehe · h8mail · theHarvester · Have I Been Pwned · Hudson Rock · LeakCheck
Domains, DNS & infrastructure	Subfinder · Amass · httpx · GAU · crt.sh · Whoxy · ViewDNS · whoisdomain · Shodan InternetDB · ipwho.is
Threat intelligence	VirusTotal · URLScan.io · GreyNoise · AbuseIPDB · AlienVault OTX · abuse.ch (URLhaus · ThreatFox · MalwareBazaar) · CIRCL · NVD · ransomware.live
Secrets & code	TruffleHog · Gitleaks · GitHub CLI
Phone	PhoneInfoga · FreeCNAM · WhoCalld
Geolocation & WiFi	OpenStreetMap · what3words · Overpass Turbo · WiGLE
Image forensics	ExifTool · TinEye · FaceCheck.id · FotoForensics · picarta.ai
Blockchain	Blockchair · Etherscan · WalletExplorer · Chainabuse
China / Sinophone recon	ENScan_GO · Kunyu · fofax · PyDork · MediaCrawler · pypinyin · OpenCC · jieba · FOFA · Quake (360) · ZoomEye · GSXT · 信用中国 · Cninfo
Payment rails & hashes	ISO 13616 / ISO 7064 (IBAN + mod-97 standards) · NAPAS / VietQR · name-that-hash
Tradecraft & methodology	SOsintOps — Speculator Project · Wukong (China-layer tool survey & access-reality matrix) · Exploratores (reversible-redaction and IBAN-analysis techniques — independently reimplemented from its published documentation; that project is AGPL-3.0 and no code was copied)
Transport tracking	ADS-B Exchange · Flightradar24 · MarineTraffic · VesselFinder
Darknet	Ahmia · OnionSearch · ransomwatch
Cloud & documents	MSFTRecon · Xeuledoc · oletools · poppler · qpdf · mat2 · The Sleuth Kit
Web archives	Internet Archive — Wayback · Waymore
Reporting & utilities	pandoc · python-docx · Matplotlib · NetworkX · jq · ASN
Standards & frameworks	OWASP · MITRE ATT&CK · STIX 2.1 (OASIS) · NIST SP 800-61 · CWE

Built something here we should credit, or want your project's listing changed/removed? Open an issue or PR — we'll fix it fast. 💙

---

Made with purpose by Hieu Ngo

     

_{If this tool helps your work, consider giving it a star. It helps others find it.}