OSINT investigation and threat-hunting console
Build an OSINT investigation and threat-hunting console: a single web app where an analyst pastes one or many indicators (auto-detected) and gets an aggregated intelligence report drawn from many public and keyed sources at once. It exists to give analysts a fast, passive, single-pane triage tool — everything is public-source, read-only toward external services, and the analyst confirms every fact. Trigger and surfaces. Serve a dark, terminal-style React web app at a route like /osint, tenant-authenticated. Add a second, tenant-authenticated web app (a "Guided Investigation Workbench") for the manual, photo-subject investigation workflow when a photo has no useful EXIF. Both are browser-triggered pages. Behind the UI, build internal JSON API endpoints (tenant-auth, called by the front end): An investigate endpoint that accepts an indicator type + value (ip, domain, url, hash, cve, asn, wallet, mac, phone, and a multi-field "person" identity search), fans out to the relevant sources in parallel, and returns a normalized list of source results — each with a status, one-line summary, and raw data — plus a server-computed verdict (level, score, rationale, signals). Support an AUTO/BULK mode that tokenizes a mixed paste and auto-detects each indicator's type, and stream single-indicator results over Server-Sent Events so cards render as each source settles. A photo-metadata endpoint that parses EXIF/XMP/IPTC, reverse-geocodes any embedded GPS, and surfaces key findings; the UI adds client-side reverse-image-search and geolocation pivot toolkits. A web-archive lookup endpoint (Wayback-style, keyless). History endpoints that record and read each analyst's recent investigations (keyed by authenticated email). Design points. Add a 24-hour response cache in a persistent volume (write cache entries in a downstream step so a write conflict never fails the analyst's response); per-analyst history in another volume. Wrap every external call in a retry/backoff wrapper that classifies failures as degraded vs empty vs error so a blank result reads as "source down," not "nothing found." Include a client-side techniques/tradecraft reference and an about/methodology view. Keep it read-only toward all external services. Sources. Use a broad set of free/keyless sources (e.g. ip-api, RDAP/WHOIS, DNS-over-HTTPS, Certificate Transparency, Gravatar, Shodan InternetDB, NVD/EPSS/CISA KEV, RIPEstat, OpenStreetMap Nominatim, blockchain explorers, OFAC sanctions list, libphonenumber) plus keyed threat-intel sources via connectors — I used VirusTotal, AbuseIPDB, GreyNoise, and urlscan.io, but treat each as swappable for your team's preferred equivalent. A missing keyed connector should surface as an error on just that one source while the rest still return. Tools used: VirusTotal, AbuseIPDB, GreyNoise, urlscan.io, Cloudflare, Cert Spotter, Gravatar, Shodan InternetDB, Blockchair/blockchain.info, macvendors, OpenStreetMap, Internet Archive Wayback, archive.today, DuckDuckGo
What this prompt builds
An OSINT investigation and threat-hunting console that aggregates intelligence from dozens of public and keyed sources into a single web dashboard. Analysts paste indicators (IPs, domains, hashes, CVEs, phone numbers, photos, or mixed inputs) and receive auto-detected, parallel lookups across threat-intel feeds, blockchain explorers, certificate transparency logs, DNS records, geolocation services, and more. The workflow surfaces a normalized verdict with level, score, and rationale while maintaining full audit history and a read-only posture toward all external services.
The problem
Security analysts and threat hunters who investigate IPs, domains, file hashes, CVEs, phone numbers, wallet addresses, or photos typically pivot across dozens of separate OSINT tools and threat-intelligence feeds — a slow, manual process that fragments context and risks missing critical signals. This workflow builds a single web console that accepts one indicator or a mixed paste of many, auto-detects each type, fans out parallel lookups to both free (ip-api, RDAP, Certificate Transparency, Shodan InternetDB, NVD, blockchain explorers, OFAC sanctions) and keyed sources (VirusTotal, AbuseIPDB, GreyNoise, urlscan.io), and returns a normalized intelligence report with a computed verdict, level, score, and rationale. Analysts get fast, passive triage in one pane without leaving the browser, while the platform logs every investigation for audit and maintains a strictly read-only posture toward all external services.
Solution and impact
The workflow delivers a dark, terminal-style React dashboard and a guided photo-investigation workbench, both tenant-authenticated and streaming results over Server-Sent Events so each source card renders as it settles. Behind the UI, internal JSON APIs fan out to 20+ sources in parallel, classify failures as degraded versus empty versus error, and cache responses for 24 hours to speed repeat lookups. Security teams gain a single-pane OSINT console that cuts investigation time from minutes of tool-hopping to seconds of paste-and-review, surfaces vetted tradecraft references inline, and ensures every fact is confirmed by the analyst before action.