WhoCord

An interactive OSINT canvas that grows with every discovery. Start with a seed — a Discord user, username, email, domain, phone, image, or URL — and watch the map build itself in real time.

Screenshots

Gallery: 1 · 2 · 3

1. Start page	2. Canvas with details panel
3. Multiple investigation trees (392 nodes, 391 edges)

Features

Modules

• Discord — profile, connected accounts, bio, avatar, message-history link search
• Username — User Scanner, WhatsMyName, Maigret, Linkook, Blackbird (600+ platforms)
• Email — Holehe, HIBP, h8mail, EmailRep, GHunt, Scylla, Gravatar, MOSINT, SMTP verify
• Domain — WHOIS, DNS, SSL, subdomains, IP geolocation, Wayback
• Phone — validation, carrier lookup, PhoneInfoga
• Image — EXIF, GPS, perceptual hash, reverse image search, OCR
• URL — HTTP trace, redirects, page metadata, Safe Browsing check
• Probe — auto-detects input type and routes to the right module
• Pivot — recursively investigates new emails and usernames (depth-limited)

Intelligence

• Knowledge graph built with networkx
• Five correlation detectors: avatar reuse, email-platform clusters, username variants, name-email links, location consistency
• AI narrative via Groq (Llama 3.3 70B)

Canvas

• Live findings over Server-Sent Events
• Searchable card view, AI chat, theme editor, PNG and .whocord-map export
• Command palette (Cmd/Ctrl+K)

Reports

• Self-contained HTML report (works offline)
• AI persona summary and markdown report

Installation

1. Prerequisites

• Python 3.10+
• Node.js 18+ (only for the modern canvas UI)
• Git
• whois — sudo apt install whois / brew install whois

2. Clone and set up

git clone https://github.com/Siv-nick/WhoCord.git
cd WhoCord
python3 -m venv .venv
source .venv/bin/activate          # Windows: .venv\Scripts\activate
pip install --upgrade pip
pip install -r requirements.txt

3. External OSINT tools

pip install user-scanner maigret linkook socialscan
pip install holehe h8mail gitfive socid-extractor
pip install theharvester

Optional: pip install toutatis sharetrace. Scylla and PhoneInfoga need manual downloads. Blackbird is cloned on first use.

4. Build the frontend (optional)

cd frontend
npm install
npm run build
cd ..

5. Run

python web_app.py

Open http://127.0.0.1:5000.

6. Set API tokens

Set them from the Config panel in the web UI. They are stored in your OS keyring.

Full setup

git clone https://github.com/Siv-nick/WhoCord.git
cd WhoCord
python3 -m venv .venv
source .venv/bin/activate
pip install --upgrade pip
pip install -r requirements.txt
pip install user-scanner maigret linkook socialscan holehe h8mail gitfive
cd frontend && npm install && npm run build && cd ..
python web_app.py

Usage

Web UI: open http://127.0.0.1:5000, click Blank canvas, press Cmd/Ctrl+K, pick a module, enter a target.

CLI:

python -m discord_osint --mode discord \
  --target 123456789012345678 \
  --token "YOUR_TOKEN" \
  --guild 987654321098765432

python -m discord_osint --mode manual --target johndoe
python -m discord_osint --interactive

Configuration

Settings live in discord_osint/config.json. Tokens live in the OS keyring.

Common flags:

Full list: discord_osint/tools_config.py.

When pivoting is on, every new email or username becomes a seed for a child investigation. Configure with PIVOT_EMAIL, PIVOT_USERNAME, PIVOT_MAX_DEPTH (default 3), PIVOT_MAX_SEEDS (default 5), and PIVOT_REQUIRE_CONFIRM.

Architecture

discord_osint/
  __main__.py                 CLI entry
  config.py / config_service.py
  core.py                     Intel store
  discord_api.py              Discord profile and message search
  scraping.py                 Platform scrapers
  email_intel.py              Email tools
  extras.py                   WHOIS, Wayback, EXIF, reverse image
  api_extractor.py            Derives JSON endpoints from URLs
  username_search.py          User Scanner, Maigret, Linkook, Blackbird
  wmn_scanner.py              WhatsMyName

  intelligence/               Graph, correlations, narrative, HTML report
  pipeline/                   Stages, context, pivot, events

frontend/                     React, TypeScript, Vite, Tailwind
web_app.py                    Flask backend

Pipeline order:

DiscordModeStage -> Discovery -> Scraping -> Media
  -> Analysis -> Intelligence -> EmailIntel -> [Pivot] -> Reporting

Development

pytest tests/ -v

Disclaimer

WhoCord is for authorised security research, red-team engagements, penetration testing, and checking your own digital footprint. Using it to stalk, harass, or dox someone, to bypass privacy protections you are not authorised to bypass, to violate Discord's Terms of Service, or to break any law is illegal. You are responsible for how you use this tool. The authors are not liable for misuse.