awesom3alex/osint-menacePassive OSINT triage console for email, username, domain, IP, and crypto wallet reconnaissance. Features case management, curated resource links, and exportable reports for defensive research.
v0.1.0 – Beta: Works on My Machine Edition
See CHANGELOG.md for this release's changes and beta scope.
Open-Source Recon Console
Built for Hunters, Not Browsers.
OSINT Menace is a Defensive Thinking Project.
OSINT Menace is a Python application for case-driven OSINT research, with a terminal workspace and a Dockerized web interface. Analysts can collect public-source observations, review results, save useful findings to cases, and export reports.
The tool is designed for defensive research, digital footprint review, investigation note-taking, and authorized security work. It favors passive lookups, generated source links, public records pivots, DNS/RDAP information, certificate transparency, wallet explorers, and analyst-controlled case management.
This is an early local build intended to grow into a fuller site later. The current version is useful as a local analyst console and Docker-hosted prototype.
Check the installed version with python menace.py --version.
See CLI.md for the complete terminal workflow and command reference.
Terminal searches support GitHub/Bluesky/GitLab/Hacker News public profiles,
phone metadata, Bitcoin/Ethereum summaries and recent transactions, public page
text/excerpts, and structured record-source matches. Username/Auto searches default
to direct checks plus the full candidate profile-link list; other types default
to collection. Choose --mode links, --mode collect, or --mode both explicitly.
The CLI also provides the OSINT Links catalog and standalone HTML exports.
SEC and CourtListener require source configuration; the CLI reports missing configuration and blocked/rate-limited
requests explicitly. See the coverage and credentials table in the CLI guide.
Run OSINT Menace without starting a browser or web server:
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python menace.py
The numbered menu supports an active case, selective saves, duplicate detection, case/item management, review statuses, notes/tags, guided dossier editing, batch input, and a Word/Markdown/JSON/HTML report wizard. Direct commands support the same saved-data operations:
python menace.py search exampleuser --type username
python menace.py search example.com --type domain --json
python menace.py create "Investigation One"
python menace.py cases
python menace.py search exampleuser --type username --case CASE_ID --link 1 --link 3
python menace.py dossier --fields
python menace.py dossier CASE_ID --field summary --value "Analyst summary here"
python menace.py show CASE_ID
python menace.py export CASE_ID --format docx --output investigation.docx
python menace.py export demo --format docx --output demo.docx
--case saves the full result unless --link selects numbered links from a
single target. Links remain candidates until the analyst verifies them.
--data-dir /path/to/data before the command selects another data directory;
the default is this checkout's data folder. Word exports use saved dossier
fields. Existing output files are never overwritten.
Use python menace.py --help or python menace.py search --help for flags.
The original osint_tool.py search CLI remains available.
data/cases.OSINT Menace is intentionally conservative by default.
Included by default:
Excluded by default:
Auto mode accepts mixed targets separated by new lines, commas, or semicolons. It detects likely target types and runs the matching modules.
Examples:
[email protected]
John P. Smith
example.com
1.1.1.1
0x0000000000000000000000000000000000000000
Email searches include:
Username searches include:
{username}.Phone searches include:
Signal and Life360 account discovery are intentionally not automated.
Full-name searches include:
Domain searches include:
IP searches include:
Wallet searches include:
Cases are the working folders for an investigation. They are stored in:
data/cases/
The case workflow supports: