PHION
Files 16 Uptime 345d Latest 28d

New OSINT tools: what shipped in July 2026

By burt Published 2026-08-04 Class Privacy & Security Tools Read 14 min

Five open-source OSINT projects shipped a release between 27 June and 25 July 2026. This is an account of each one: what it does, the mechanism it depends on, and where it stops working. Every date here comes from the project’s own repository, release page or announcement, not from a roundup post.

Two of the most-starred “new OSINT platform” repositories on GitHub right now are not releases at all. One contains no code. The other carries a memecoin contract address in its description. Both are covered at the end, along with the checks that tell them apart from the real ones in about a minute.

Star counts and download figures in this article were read on 31 July 2026 and will have moved since.

Trace Labs OSINT VM 2026.07

Trace Labs released version 2026.07 of its OSINT virtual machine on 25 July 2026. Trace Labs runs crowdsourced search-party CTFs where competitors gather open-source information on real missing-persons cases and submit it to law enforcement, and the VM is the standard environment for those events.

The notable change in 2026.07 is an ARM64 build on Debian Trixie for QEMU-based hypervisors, which brings the image to Apple Silicon hosts without x86 emulation. The rest of the release is repair work: a patch to the SpiderFoot installer so installation completes, fixes for several other tool installs, and changes to how images are distributed. The VirtualBox OVA is 1.8 GB and the VMware OVA 1.91 GB; a full build with every tool pre-installed is 5–6 GB. There is also a standalone tlosint-tools.sh script that installs the toolset onto an existing Debian system, which is the sensible option if you already run one.

The structural change came one release earlier. In 2026.05, released 26 May 2026, the build moved off Kali Linux and onto Debian 13. Trace Labs explained the reasoning on 13 July: their work runs on publicly available information, so exploit kits, packet analysers and port scanners were shipping in the image without ever being used for the mission. Starting from a clean Debian base removed them and shrank the result.

That is a more interesting decision than it first appears. A general-purpose offensive distribution is a liability in this specific context — volunteers are handling data on live missing-persons cases and passing findings to police, and a VM full of intrusion tooling invites questions about how the information was obtained. The same release added Obsidian with case templates, the Owlculus case-management toolkit, and a forensic capture extension in the browser, which is the shape of a note-taking and evidence-handling environment rather than a red-team one.

The repository is GPL-3.0 and has been public since January 2023. Planned work named in the announcement includes a GNOME desktop option and Qubes OS compatibility.

CommiPiste

CommiPiste appeared on 27 June 2026, written by soxoj, who also maintains the username-search tool Maigret. It identifies which exact commit of an open-source web application a server is running, then looks up the vulnerabilities affecting that commit.

The mechanism is the part worth understanding. Git names every file by hashing it in a specific way: the SHA-1 of the string blob, a space, the byte length of the file, a null byte, and then the file’s contents. That value is the blob object ID, and it is what git ls-tree prints for each file in a commit. Nothing about it depends on the repository, the branch, or the clock — the same bytes always produce the same OID.

Applications such as WordPress, phpBB, MediaWiki, Roundcube and GLPI serve their CSS and JavaScript straight from source, unmodified. So the stylesheet a public server hands you is byte-identical to a file committed to that project’s Git history, and reproducing its blob OID from the downloaded bytes gives you a key you can look up in an index of every commit that touched that path.

CommiPiste’s fingerprinting step. A static file is downloaded from the target, its Git blob OID is recomputed from the received bytes, and that hash is matched against an index of commits that touched the same path. Because the server is serving committed source rather than a build artefact, the match resolves to specific commits rather than a version range.

Building the index is where the engineering shows. Cloning the full history of hundreds of projects to read file hashes would be enormous, so CommiPiste uses a blobless clone — git clone --filter=blob:none — which fetches commit and tree metadata but no file contents. The blob OIDs are recorded in the trees, so the clone never needs the bytes it is naming. The project’s documentation puts the saving at roughly 25× on clone size.

The vulnerability lookup then exploits something most scanners cannot use. The documentation describes three sources: the NIST NVD, queried by CPE product and version and rate-limited to about five requests per 30 seconds; Shodan’s CVEDB, which answers the same query without a key or rate limit; and OSV, which is queried by commit — the advisory’s affected Git range either contains that commit or it does not. Version-string matching cannot make that distinction for anyone running a commit between two tags. Results from the three are merged and deduplicated by CVE ID, keeping the highest CVSS score. The documentation also notes that OSV’s commit query is API-only, so reports link the commit for manual checking rather than pointing at a web search that cannot be reproduced.

pip install -e .
CommiPiste scan https://example.com
CommiPiste scan https://example.com --report out.html
CommiPiste scan --targets hosts.txt

The signature database is distributed as a release asset rather than built locally: signatures.db.gz, 21.7 MB compressed, described in its release note as covering 162 projects as at 27 June 2026. The README says the bundled database covers over 200 platforms, so treat 162 as the figure with a date attached to it. Software outside the database can be indexed on demand by pointing the tool at a repository with --autoindex --repo. WordPress.org plugins are handled separately, indexed over that registry’s HTTP Subversion interface.

The limits are documented clearly, which is not universal in this category. Anything serving build artefacts is out of reach: single-page applications such as Grafana, Kibana and Discourse ship minified bundles with content-hashed filenames, GitLab serves webpack output, and Gitea, Jenkins and Keycloak embed assets in the binary or package. In each case the served bytes never existed in the repository, so no blob OID will ever match. Supporting them would mean indexing release tarballs or container images instead of Git history. Licence is MIT.

tempolocus

tempolocus reached v1.0.0 on 10 July 2026, three days after the repository was created. It comes from the AIL Project, the group behind the AIL framework for detecting and analysing information leaks. The tool takes the times at which an account was active and infers a timezone, and from there a shortlist of countries.

The reasoning is that people sleep. Aggregate a few hundred timestamps into 24 hourly buckets and a six-hour trough appears where the account’s owner was in bed. That trough sits at a fixed position in UTC, and the offset that maps it onto local night is the offset the person keeps.

The inference tempolocus performs. Activity is bucketed by UTC hour; candidate offsets are tested until local midnight to 06:00 lines up with the quiet block. The profile shown is illustrative rather than measured. Ranking offsets this way narrows the field, but the tool’s own documentation notes that weekly data alone cannot resolve a single IANA timezone.

It accepts three input shapes: weekly hourly buckets given as day, hour and count; yearly daily buckets; or a plain list of timestamps as UTC strings or Unix epoch seconds, which it aggregates itself. Output is JSON — ranked UTC offsets with IANA zone labels, a list of probable countries, a confidence figure, and a classification of the activity as work-time, vacation-time or mixed.

python -m tempolocus samples/weekfull-chan1.json
tempolocus data.json --top 10 --holiday-profile public-worker

The yearly analysis is the more discriminating half. Daily counts across a year contain dips on public holidays, and the pattern of which days go quiet differs by country in a way a timezone offset does not. tempolocus carries holiday data for more than 60 countries across six regions and ranks them against the observed dips. An account that goes quiet on 26 January and again in late April is telling you something a UTC offset never could.

The project describes its own output as a heuristic first pass, and the caveats are real. Weekly data without dates cannot pick between IANA zones that share an offset. Yearly analysis depends on what the counter is actually measuring — scheduled posts, bot activity or a shared account will each produce a shape that means nothing. The output is a ranking to be corroborated, not a location. Licence is AGPL-3.0-or-later.

Cerast Live Search

Cerast Live Search was posted to Hacker News on 5 July 2026, where it drew 58 points. It is a searchable index of files that public web servers are exposing without meaning to: .git directories, .env files and backups. Readers working through the results in the thread remarked on how much .DS_Store turns up — the metadata file macOS writes into every folder, which lists that folder’s contents and gets uploaded along with everything else.

Host discovery comes from Certificate Transparency logs. Every certificate issued by a public CA is published to append-only logs that anyone can read, which is the mechanism that lets domain owners detect certificates issued for their names without permission. It also means that issuing a certificate for an internal-sounding hostname announces that hostname to everyone watching the logs. Crawlers subscribe to the log feed, extract the names, and probe them. Several commenters in the thread noted they had not realised their internal subdomains were public the moment they were certified.

The developer submitted the tool themselves and answered questions in the thread: asked whether it re-skins an existing service, they said they crawl everything independently, and separately that they excluded .gov from the crawl to avoid the trouble. The API is free on request, with the stated condition of explaining what you intend to use it for. Per the site’s imprint, Cerast Intelligence is a sole trader based in Fulda, Germany.

The thread contains a substantive objection, and it is worth repeating rather than skipping. One commenter reported being probed for these paths within seconds of issuing a TLS certificate, and argued that scanning without consent is abuse regardless of who is doing it. That is a fair description of what CT-driven crawling is. The counter-argument in the thread — that the same paths are already being probed continuously by people with worse intentions — is true, and does not make the tool’s crawl consensual. If you run public infrastructure you are already in this index or one like it; the practical response is to check what you expose, not to expect not to be looked at.

Akashic, and the Palantir-alternative genre

Akashic tagged v0.1.0 on 12 July 2026 and was posted to Hacker News on 19 July. It is a self-hosted map workspace that pulls live public feeds onto one globe: aircraft, satellite orbits, earthquakes, weather and air quality, disaster alerts, radio stations, and OpenStreetMap building data. The stack is Next.js 15 with deck.gl and MapLibre, and it runs without API keys because every default source is open — Celestrak for orbital elements, the USGS for earthquakes, GDACS for disaster alerts, Open-Meteo for weather, Overpass for buildings, Wikidata for entity facts.

Its README is honest about what that means, listing the failure modes plainly: public feeds vanish without notice, aircraft and satellite positions are interpolated between updates, building coverage varies by region, and the reconnaissance results need human verification. That paragraph is a better guide to the tool than its own description of itself as a Palantir alternative, which is doing a lot of work for a project that at the time of writing has 85 stars and about eight commits of history.

Akashic sits in a genre that appeared in the first half of 2026. Its licence notice credits World Monitor by Elie Habib, from which parts of the strategic layer model and geographic registries were adapted under the AGPL, with the original notices retained. That is attribution done correctly, and it is the reason the lineage is traceable at all.

World Monitor itself is the outlier of the group. Created on 8 January 2026, it has 77,239 stars, 11,530 forks and 5,218 commits, aggregating more than 65 providers into 500-plus feeds. Whatever one makes of the category, a repository going from creation to 77,000 stars in under seven months is a genuine measure of how much appetite there is for a public-data situational-awareness dashboard.

One inconsistency worth noting in Akashic: the install instructions in the README tell you to clone github.com/nullure/Akashic, while the project lives at CaviraOSS/Akashic. Harmless — an organisation rename that the docs have not caught up with — but it is exactly the kind of detail worth resolving before you paste a command from a README you have not read.

Two repositories that are not releases

God’s Eye View has 568 stars. It contains no code. The README, which is candid about this, records that the placeholder repository was created on 22 June 2026 and that a launch date of 18 August 2026 was set on 30 July. The underlying project — live flights, vessels, submarine cables and public camera feeds rendered on a photorealistic globe — comes from a video series by Bilawal Sidhu and looks substantial. It is simply not released, and the star count is a mailing list for a launch, not evidence of software.

OSIRIS is a different problem. It has 7,334 stars and 1,504 forks, describes itself as an open-source global intelligence platform and a Palantir alternative, and ends its GitHub description with the words “We Get 0.5% on Volume Traded” followed by a Solana address whose pump suffix identifies it as a pump.fun launch. The repository has real code in it. It also has a financial instrument attached to its popularity, which changes what the star count measures. Run it in a container if you run it at all, and read what it sends outbound.

Neither case requires special insight to catch. Both are visible in the first minute of looking.

Checking a new tool yourself

Repository metadata answers most questions about whether a tool is what a roundup post says it is. The GitHub API allows 60 unauthenticated requests an hour, which is enough.

curl -s https://api.github.com/repos/OWNER/REPO \
  | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d["created_at"], d["pushed_at"], d["stargazers_count"], d["license"])'

A creation date far older than the “new in 2026” claim means the roundup found an existing project. A pushed_at months behind the star count means attention arrived after the work stopped. A null licence means you have no permission to use the code, whatever the README implies.

Commit count is the fastest quality signal, and there is a trick for reading it without downloading history. Request one commit per page and read the pagination header: the page number in the rel="last" link is the total number of commits.

curl -sI "https://api.github.com/repos/OWNER/REPO/commits?per_page=1" | grep -i '^link'

A tool with thousands of stars and eight commits is a README that went viral. A tool with 55 commits over three days is one person’s focused week, which may be excellent, but is not a maintained project yet.

Then check the release itself, because a Git tag costs nothing to create:

curl -s https://api.github.com/repos/OWNER/REPO/releases \
  | python3 -c 'import sys,json; [print(r["tag_name"], r["published_at"], [(a["name"], a["download_count"]) for a in r["assets"]]) for r in json.load(sys.stdin)]'

Download counts on release assets are the one number in this ecosystem that is hard to inflate casually. The Trace Labs 2026.05 VirtualBox image shows 2,769 downloads against 2026.07’s 570 — a distribution of exactly the shape you would expect two months after one release and six days after the next.

Two further checks take seconds each. Read the licence file rather than the badge. And read the README’s install command before running it: Akashic’s points at a repository path that no longer exists, which is benign, but the same mismatch is how a typosquatted clone gets executed.

Limitations

This covers open-source tools with public repositories and dated releases. Commercial OSINT platforms ship on their own schedules and rarely publish anything a reader can verify independently, so they are absent by construction rather than by judgement.

Release dates establish when code was published. They say nothing about whether it works well, and none of these tools has enough history for anyone to know whether they will be maintained. CommiPiste, tempolocus, Akashic and Cerast are all weeks old.

The scanning tools here touch third-party systems. CommiPiste fetches static files and can send active probes; Cerast crawls hosts that never asked to be crawled. Fingerprinting infrastructure you do not own or have permission to test is unlawful in many jurisdictions, including under Australia’s Commonwealth computer-offence provisions, irrespective of how passive the requests look.

tempolocus infers where a person sleeps from when they post. Applied to an account belonging to someone who has not consented, that is surveillance, and its accuracy is unquantified — the project describes its own output as a first pass. Treat a confident-looking ranking as a lead requiring corroboration.

Star counts, download figures and repository statistics were read on 31 July 2026 and change continuously.

Sources