OsintHunter is a fully local desktop OSINT platform that turns one username, email, phone or domain into a graph of correlated findings with confidence scoring, designed for authorized investigations.

Most OSINT tooling converges on one of two shapes: the username-sweep script that dumps a list of hits, or the heavyweight framework with a steep setup tax. OsintHunter from letox4 tries to occupy the middle ground — a desktop platform that starts from a single clue (username, email, phone, name, domain, IP, or even a Chilean RUT) and builds a structured investigation graph with per-finding confidence scores, a geocoded map, a timeline and an exportable report. Written in Python 3.11+ with a FastAPI backend, it ships as a single Windows .exe that opens a browser UI at http://127.0.0.1:8787, and it holds an MIT license with 52 stars at the time of writing.

The architectural bet here is correlation over enumeration. Instead of treating each source as an independent list, every finding becomes a node in a live graph where relationships draw themselves as the modules return data. The UI lets you group nodes into bubbles by entity type, platform, or what the README calls **alias families** — arguably the most interesting primitive in the tool. The premise is that an operator facing nyxaluna, nyxa.lun4 and xnyxax should see those as one identity with leet-speak and morphological variants, not three unrelated strangers, and the tool both detects the shared root and proactively tries the missing variants across its site database.

Confidence scoring is the other half of the correlation story. Every discovered account receives a 0-100 score computed from name matches, photo similarity, location consistency and cross-links to other confirmed accounts. This directly addresses the classic OSINT failure mode: namesakes. A username sweep alone cannot tell you whether the john.smith on GitHub is the same john.smith on Instagram, and the README explicitly frames the score as evidence attached to each link — the screenshots show a per-account rationale for why an identity is or isn't the subject. For professional reporting, that provenance trail matters more than raw hit counts.

The module inventory is broad: 49 modules organized by input data type. Username inputs get detailed profile pulls from platforms like Instagram, TikTok, GitHub and Reddit, plus a sweep across 400+ sites built on the Sherlock database, deep GitHub analysis, Wayback-archived profiles and forum mention searches. Email pivots cover MX validation, Gravatar, and breach lookups via XposedOrNot and HIBP. Phone numbers resolve carrier, country and line type. Domain and IP modules bring the usual reconnaissance set — DNS, RDAP/WHOIS, subdomain enumeration through crt.sh, Shodan/InternetDB, AbuseIPDB, GreyNoise, VirusTotal, URLScan and URLhaus.

What distinguishes the module design from a simple aggregator is the inclusion of Chile-specific sources: RUT lookups, license plates, NIC Chile domain data, InfoProbidad lobbying records, company registries by RUT, and university thesis databases. This regional depth is rare in generic frameworks and signals the author's actual operating environment (the chile repo topic confirms it). It also makes the tool a useful reference implementation for anyone wondering how to integrate national public registries into a graph-based investigator — the pattern generalizes to any jurisdiction with open records.

Operational realism shows up in the retry logic. The README acknowledges that Instagram, TikTok and WAF-protected targets rate-limit or block automated lookups, and rather than pretending otherwise, the tool retries with pauses and then leaves a manual verification checklist for the operator. That honest degradation is a design decision worth noting: it keeps results auditable instead of silently dropping blocked sources, and it pushes final confirmation to human review — which is where it belongs in any defensible investigation.

The keyless operation is a genuine differentiator. OsintHunter works without a single API key, deriving most of its value from public endpoints and scraping; 13 optional integrations (Serper, Brave Search, Hunter.io, Numverify, HIBP, reputation feeds, a GitHub token raising the rate limit from 60 to 5000 requests/hour) can be added in Settings to unlock more sources. Optional AI summarization runs through local Ollama or any OpenAI-compatible provider, so case analysis doesn't require shipping sensitive investigation data to a third-party model.

Privacy posture is strongly local: everything runs on your machine, cases, settings and keys live in a data/ directory next to the executable backed by SQLite, and the README states there are no middle servers and no telemetry. One caveat the README itself flags: Windows SmartScreen will warn on the unsigned .exe, and operators should weigh running an unsigned binary from a low-star repository in a VM or building from source with build_exe.bat instead. The source path — git clone, pip install -r requirements.txt, python -m app — is straightforward and auditable, and for anything touching real subjects, auditing the code first is the professional default.

The report pipeline closes the loop: cases export to HTML/PDF ready to hand over, with the map and timeline views geocoding locations and ordering account creations, commits, breaches and archives chronologically. That output format is aimed squarely at people who deliver findings to someone else — a client, an editor, an HR team — rather than at casual snooping, and it aligns with the README's explicit responsible-use section, which restricts the tool to legitimate investigation (cybersecurity, journalism, identity verification, missing persons, self-auditing) and prohibits harassment, stalking and privacy violations.

From a defensive perspective, it's worth understanding what OsintHunter looks like from the other side. Because it queries public sources directly from the investigator's IP with no proxying, every platform it touches sees the probing traffic, and rate-limit responses are expected and handled — meaning defenders running honeypot profiles or monitoring for bulk username enumeration will see this class of activity as ordinary scraping patterns. For blue teams, the tool is equally useful in reverse: mapping your organization's exposed executive footprint or breach-exposed emails before an adversary does.

The overall assessment: OsintHunter is an ambitious single-developer project that trades cloud convenience for local control and wraps enumeration in genuine analytical structure — alias families, confidence scores, timelines, evidence-linked graphs. The bilingual EN/ES UI, fictional-subject screenshots using .example domains, and honest treatment of blocked sources all suggest a developer thinking about tradecraft and defensibility, not just hit counts. For authorized investigators, particularly those working Latin American targets or wanting a self-contained, keyless starting point, it's a repository worth watching as it matures.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• Automating Synology DSM hardening and ransomware response with nas


• Inside sony-a6400-research: emulating the BIONZ X camera platform without touching hardware


• gsocket for NAT and firewall traversal via a shared secret