Flowsint

OSINT tools come and go, so Flowsint keeps the investigation itself in a graph and treats each tool as an enricher that can be plugged in or swapped out. Analysts add entities such as domains, IP addresses, organizations, usernames or crypto wallets, then run enrichers on them: reverse DNS, subdomain discovery, WHOIS, IP to ASN, Maigret username searches across social platforms, wallet transactions and website crawls for trackers among them. Results land back in an interactive graph, and repeated steps can be saved as flows.

It is aimed at cybersecurity analysts and investigators and ships with an ETHICS.md on responsible use. Installation runs through Docker, with make prod on Linux and macOS or docker compose on Windows. Data stays on the machine by default, and a team server needs its default secrets changed and its hostname added to an allowlist before it is exposed to a network. The project describes itself as early in development and is Apache-2.0 licensed.