🕵️‍♂️ WhoCord v1.1

Turn any username, email, domain, phone number, image, URL, or probe string into a full identity profile.

WhoCord is a modular OSINT investigation platform that runs dozens of open‑source tools, builds a knowledge graph, detects correlations, and generates an AI‑enhanced dark‑themed HTML report – all streamed live to a modern React dashboard.

⚡ Features

• 8 investigation modules – Username / Manual, Discord, Email, Domain, Phone, Image, URL, Data Probe (auto‑detect).
• Discord‑native link resolution – extracts and resolves Instagram, TikTok, Facebook, and Twitter tracking links shared by a target user.
• Full identity pipeline – names, emails, locations, breach data, GitHub history, avatar metadata, and Google account info (GHunt).
• Email intelligence – Holehe (site registrations), h8mail, HIBP, EmailRep, GHunt, Blackbird email search, MOSINT (social account flags).
• Domain investigation – WHOIS, DNS records, SSL certificate, IP geolocation, subdomain enumeration, theHarvester.
• Phone investigation – number validation, carrier lookup, PhoneInfoga OSINT.
• Image analysis – EXIF metadata, perceptual hash, reverse image search, OCR text extraction.
• URL analysis – HTTP metadata, redirect trace, page metadata, Open Graph tags, Safe Browsing check, Wayback snapshot.
• Data Probe – paste anything (email, domain, phone, URL, username) and WhoCord auto‑detects the type.
• Knowledge graph & correlations – 5 detectors (avatar reuse, email‑platform cluster, username variants, name‑email link, location consistency).
• AI‑generated reports – LLaMA 3.3 (via Groq) produces structured narrative and persona summary.
• Dark‑themed HTML report – collapsible platform cards, avatar display, breach tags, pivot sub‑reports, technical data.
• Live SSE streaming – watch investigations in real time with stage list, finding cards, and console logs.
• Pivot system – recursive investigation of discovered emails/usernames with user confirmation modal.
• Secure token storage – API keys stored in your OS keyring, never in plain text.
• Web dashboard – run investigations from your browser, toggle tools, manage tokens, view history.

🚀 Quick Start (recommended)

1. Download the portable zip from the Releases page (Linux 64‑bit, ~500 MB).
2. Extract the archive anywhere:
   root@kitploit:~

   unzip WhoCord.zip -d WhoCord
   

3. Run the web dashboard:
   root@kitploit:~

   cd WhoCord
   ./run.sh
   

   (opens your browser automatically)

No Python, pip, or tool installation is required – everything is bundled inside.

📦 Installation (from source – for developers)

1. Clone the repository

git clone https://github.com/Siv-nick/WhoCord.git
cd WhoCord

2. Create a Python virtual environment

python3 -m venv venv
source venv/bin/activate   # Linux / macOS

3. Install WhoCord and its Python dependencies

pip install -e .

4. Install external command‑line tools (most via pip)

All required tools can be installed with a single pip install command:

# Username search tools
pip install sherlock-project maigret naminter linkook

# Email intelligence tools
pip install holehe h8mail theHarvester

# GitHub & Google tools
pip install gitfive ghunt

# Phone & image analysis
pip install phoneinfoga pillow imagehash pytesseract

# Domain investigation
pip install dnspython

5. Install Blackbird (email & username search on 600+ sites)

git clone https://github.com/p1ngul1n0/blackbird
cd blackbird
pip install -r requirements.txt
cd ..

The required data file (wmn-data.json) is auto‑downloaded on first use. If that fails, download it manually from WhatsMyName and place it in blackbird/data/.

6. Install system WHOIS (required for domain investigations)

sudo apt install whois          # Debian/Ubuntu
# brew install whois            # macOS

7. (Optional) Authenticate GHunt for Google account intelligence

ghunt login

Follow the instructions to authenticate with your Google account.

8. Build the frontend (required for source installations)

The web dashboard requires a compiled React frontend. Make sure you have Node.js 18+ and npm installed, then run:

cd frontend
npm install
npm run build
cd ..

This creates the frontend/dist/ folder that Flask serves automatically.

9. Launch the web dashboard

python web_app.py

Then open http://127.0.0.1:5000.
Or use the one‑click launcher: ./run.sh.

🚀 Usage

Web Dashboard (primary interface)

The dashboard offers eight investigation modules:

Live investigation page shows:

• Stage list with real‑time status
• Finding cards (emails, names, breaches, correlations)
• Console logs (raw tool output)
• Pivot confirmation modal (when enabled)

History page – list all past investigations with links to reports and JSON intel.

Config page – manage API tokens, toggle tools, set pivot options, upgrade tools.

Interactive menu (legacy CLI)

discord-osint

Then use the numbered menu to toggle tools, set tokens, and start investigations.

Command‑line mode (limited to manual/discord)

discord-osint --mode manual --target someusername --output html --debug

📁 Output files

All results are saved in investigation_cache/:

HTML report sections

• Identity (Discord handle, name clues, location, language, confidence scores)
• Persona Summary (AI)
• Social Profiles (collapsible platform cards with avatars, bios, extra fields)
• Email Intelligence (breach tags, MOSINT flags)
• Intelligence Analysis (graph stats, narrative, correlations)
• Pivot Sub‑Investigations
• Technical Data (WHOIS, DNS, SSL, IP geolocation, subdomains, theHarvester, phone, URL analysis, GHunt)

🛠️ Tools & technologies

WhoCord integrates these open‑source OSINT projects:

🔄 Updates

Check CHANGELOG.md for version history.

🔒 Security & privacy

• Tokens are never stored in plain text – kept in your OS keyring.
• config.json only contains non‑sensitive toggles.
• All investigation data stays on your machine inside investigation_cache/.

⚠️ Disclaimer

WhoCord is intended for educational purposes and authorised security testing only.
Do not use it to stalk, harass, or violate anyone’s privacy.
The author assumes no liability for misuse.

📄 License

MIT License