About these toolkits

Privacy-first DFIR & OSINT utilities by Pranith Jain — Security Analyst: Threat Intel & Security Automation. Every tool runs entirely in your browser; sensitive data never leaves your device.

Privacy-first

Client-side processing by default — no accidental uploads, no tracking, no accounts.

Transparent

Predictable, inspectable tool behaviour built on standard Web APIs.

Zero setup

Ready-to-use in the browser. Nothing to install, no keys to provision.

Pivot-friendly

Outputs are easy to copy, export (CSV/JSON) and link onward for investigation.

DFIR Toolkit

A collection of browser-based utilities for incident-response triage: IOC extraction, timestamp conversion, hashing, email-header analysis, log and PCAP triage, Windows artifact parsing (EVTX, registry hives, prefetch, PE), SQLite/iOS artifact inspection and more. Built for SOC analysts, DFIR responders, blue-teamers and students who need fast, trustworthy tools without setup overhead — and without shipping enterprise data to a third party.

OSINT Toolkit

Lightweight reconnaissance and collection tools: dork building, brand-impersonation discovery, username mapping, DNS/CT lookups, email OSINT, EXIF/metadata extraction, image fingerprinting, screenshot intelligence, archive/redirect analysis and reverse-image pivots. Designed for investigators, journalists and analysts who need quick, reliable utilities that keep public-record data under the operator's control.

Why I built this

Many online security tools require uploads or proxy your input through external services — an unnecessary exposure when you're handling logs, hashes, headers or reconnaissance data that can contain confidential infrastructure detail or PII. These tools take the opposite stance: modern browser APIs do the work locally, so capability doesn't cost you confidentiality.

Technical stack

Vite + React 18 + TypeScript, client components, statically prerendered
Tailwind CSS for styling
Web Crypto API, File API and Canvas for local processing; lazy WASM (sql.js) loaded per-tool on demand
Hand-rolled binary parsers (PE, regf, EVTX, prefetch/LZXPRESS-Huffman, pcap, plist, protobuf) — no server round-trips
CSV/JSON export via the File API
Deployed on Cloudflare Workers (edge) with strict CSP — privacy-first, client-side processing

Data sources & disclaimer

Disclaimer

This platform aggregates data from the following sources for reference and decision-support purposes only. Source reliability varies — always validate indicators in your own environment before taking action. The platform does not verify, endorse, or guarantee the accuracy of third-party data.

Backend data sources (32)

Reliability graded per NATO Admiralty Code (A=best, F=unassessed). Risk level indicates how much corroboration is recommended before acting on data from each source.

Ransomlook — Leak-site scraping — ransomware group onion postsOnly claims posted to leak sites

low

ransomware.live PRO — Authenticated API — ransom notes, negotiation logs, victim claims

low

cti.fyi — Leak-site post tracker — victim claims with .onion screenshotsOnly claims posted to leak sites

low

X / FalconFeeds + DailyDarkWeb — Ransomware + breach claims parsed from threat-intel X posts (free text)Heuristic extraction from prose — lower precision; unverified actor claims

medium

CISA KEV — Known Exploited Vulnerabilities — authoritative US govt

low

NVD — National Vulnerability Database — official CVE repo

low

Malpedia — Curated malware family reference (Fraunhofer FKIE)

low

URLhaus — Confirmed malicious URLs (abuse.ch)

low

ThreatFox — Confirmed malicious IOCs with context (abuse.ch)

low

MalwareBazaar — Confirmed malware samples with hashes (abuse.ch)

low

PhishTank — Crowdsourced phishing verification

low

OpenPhish — Curated commercial phishing feed

low

Cert Spotter / crt.sh — Certificate Transparency log search

low

Hudson Rock — Infostealer victim dataOnly infostealer-compromised machines

moderate

LeakCheck — Breach database aggregator

moderate

XposedOrNot — Breach aggregation service

moderate

IPsum — Consensus-scored malicious IPs from 3+ lists

moderate

CINS Army — Active malicious IP list

moderate

Bitwire IP Blocklist — IP blocklist

moderate

MyThreatIntel — Commercial CTI platform

moderate

AbuseIPDB — Crowdsourced IP reputation

moderate

AlienVault OTX — Open Threat Exchange pulses

moderate

VirusTotal — Multi-engine file scanner

low

Telegram Cybersec — Public Telegram channels — IOC drops, leak announcementsQuality varies by channel

high

Telegram Leak Monitor — Auto-scanned Telegram for leaksScanner heuristics produce false positives

high

Reddit Cybersec — 16 cybersec subredditsDiscussion may include unsubstantiated claims

high

X/Twitter Cybersec — Researcher tweets & IOC drops

high

Bluesky Cybersec — Researcher posts (smaller community)

high

AI Copilot Analysis — LLM-generated assessmentMay hallucinate attribution or IOCs

critical

Actor DNA Analysis — AI-driven actor profilingPattern-matching may produce false associations

high

Heuristic CVE→Actor — Keyword-based CVE→actor matchingMatches may be coincidental

high

Predictive Intel — Forward-looking pattern extrapolationNovel TTPs not covered

critical

Open source tools & libraries

ViteReact 18TypeScriptTailwind CSSCloudflare WorkersWranglerLucide ReactReact RouterRechartsLeafletD3 / vis-networkSTIX 2.1NATO Admiralty Codesql.js (WASM)

About these toolkits

Privacy-first DFIR & OSINT utilities by Pranith Jain — Security Analyst: Threat Intel & Security Automation. Every tool runs entirely in your browser; sensitive data never leaves your device.

Privacy-first

Client-side processing by default — no accidental uploads, no tracking, no accounts.

Transparent

Predictable, inspectable tool behaviour built on standard Web APIs.

Zero setup

Ready-to-use in the browser. Nothing to install, no keys to provision.

Pivot-friendly

Outputs are easy to copy, export (CSV/JSON) and link onward for investigation.

DFIR Toolkit

OSINT Toolkit

Why I built this

Technical stack

Vite + React 18 + TypeScript, client components, statically prerendered
Tailwind CSS for styling
Web Crypto API, File API and Canvas for local processing; lazy WASM (sql.js) loaded per-tool on demand
Hand-rolled binary parsers (PE, regf, EVTX, prefetch/LZXPRESS-Huffman, pcap, plist, protobuf) — no server round-trips
CSV/JSON export via the File API
Deployed on Cloudflare Workers (edge) with strict CSP — privacy-first, client-side processing

Data sources & disclaimer

Disclaimer

Backend data sources (32)

Reliability graded per NATO Admiralty Code (A=best, F=unassessed). Risk level indicates how much corroboration is recommended before acting on data from each source.

Ransomlook — Leak-site scraping — ransomware group onion postsOnly claims posted to leak sites

low

ransomware.live PRO — Authenticated API — ransom notes, negotiation logs, victim claims

low

cti.fyi — Leak-site post tracker — victim claims with .onion screenshotsOnly claims posted to leak sites

low

X / FalconFeeds + DailyDarkWeb — Ransomware + breach claims parsed from threat-intel X posts (free text)Heuristic extraction from prose — lower precision; unverified actor claims

medium

CISA KEV — Known Exploited Vulnerabilities — authoritative US govt

low

NVD — National Vulnerability Database — official CVE repo

low

Malpedia — Curated malware family reference (Fraunhofer FKIE)

low

URLhaus — Confirmed malicious URLs (abuse.ch)

low

ThreatFox — Confirmed malicious IOCs with context (abuse.ch)

low

MalwareBazaar — Confirmed malware samples with hashes (abuse.ch)

low

PhishTank — Crowdsourced phishing verification

low

OpenPhish — Curated commercial phishing feed

low

Cert Spotter / crt.sh — Certificate Transparency log search

low

Hudson Rock — Infostealer victim dataOnly infostealer-compromised machines

moderate

LeakCheck — Breach database aggregator

moderate

XposedOrNot — Breach aggregation service

moderate

IPsum — Consensus-scored malicious IPs from 3+ lists

moderate

CINS Army — Active malicious IP list

moderate

Bitwire IP Blocklist — IP blocklist

moderate

MyThreatIntel — Commercial CTI platform

moderate

AbuseIPDB — Crowdsourced IP reputation

moderate

AlienVault OTX — Open Threat Exchange pulses

moderate

VirusTotal — Multi-engine file scanner

low

Telegram Cybersec — Public Telegram channels — IOC drops, leak announcementsQuality varies by channel

high

Telegram Leak Monitor — Auto-scanned Telegram for leaksScanner heuristics produce false positives

high

Reddit Cybersec — 16 cybersec subredditsDiscussion may include unsubstantiated claims

high

X/Twitter Cybersec — Researcher tweets & IOC drops

high

Bluesky Cybersec — Researcher posts (smaller community)

high

AI Copilot Analysis — LLM-generated assessmentMay hallucinate attribution or IOCs

critical

Actor DNA Analysis — AI-driven actor profilingPattern-matching may produce false associations

high

Heuristic CVE→Actor — Keyword-based CVE→actor matchingMatches may be coincidental

high

Predictive Intel — Forward-looking pattern extrapolationNovel TTPs not covered

critical

Open source tools & libraries

ViteReact 18TypeScriptTailwind CSSCloudflare WorkersWranglerLucide ReactReact RouterRechartsLeafletD3 / vis-networkSTIX 2.1NATO Admiralty Codesql.js (WASM)