FRESH

Hacker News

Home

Show HN: I built a real-time OSINT dashboard pulling 15 live global feeds

304 points by vancecookcobxin

by afatparakeet

2 subcomments

Optimizing some of that geojson into realtime tiles is a really fun and engaging project.
Have you seen these projects?
https://github.com/protomaps/PMTiles
https://github.com/maplibre/martin

by totetsu

0 subcomment

Is this kind of Hyper-awareness of data you can't actually do anything about even a desirable thing, or just a pathway into a hole of hyper-alert stress and low Self-efficacy?

by RovaAI

0 subcomment

Great execution on aggregating live feeds. Two questions from someone who does similar work on the B2B side:
1. How do you handle deduplication when the same event surfaces across multiple feeds simultaneously? For news aggregation this is the hard part - an event that appears in Reuters, Bloomberg, and 12 downstream outlets is one story, not 13.
2. What's your rate limiting strategy across 15 sources? Some of the better data APIs (Shodan, GreyNoise, etc.) have strict per-minute limits that become a real constraint at even modest query frequencies.
The B2B application of this pattern is company intelligence - pulling company news, job postings, funding signals, and tech stack changes from 10+ sources and surfacing the relevant signal per account. Same architecture challenge (deduplication, rate limits, signal:noise ratio) with a much smaller initial data volume but higher precision requirements per entity.

by ahannigan

1 subcomments

Looks similar to https://monitor-the-situation.com/

by vavkamil

5 subcomments

You leaked `./frontend/.env.local` & `./backend/.env` inside `ShadowBroker_v0.1.zip` in the first commit.

by CountGeek

2 subcomments

This is neat. It reminds me of this https://curves-voluntary-livecam-sandra.trycloudflare.com/

by tylervigen

0 subcomment

> ShadowBroker is a real-time, full-spectrum geospatial intelligence dashboard
You might consider changing this to a more accurate headline, like "Air and Space domain awareness."
"Full spectrum Geospatial intelligence" most commonly refers to full color satellite photos (sometimes including near infrared).
In the Geospatial world, "spectrum" almost always takes on its literal meaning - the spectrum of light. And "Geospatial intelligence" refers to intelligence gathered from Geospatial platforms, not intelligence about the locations of those platforms.

by 4mitkumar

0 subcomment

Very cool! Although, the concept, the feeds, the design and everything reminds me of https://www.worldmonitor.app/ - also live and deployed btw, if you want to check out the interface.

by ionwake

1 subcomments

Really cool thanks for sharing. What are the API costs like if i ran this for a couple hours a day for a month? Is it affordable?

0 subcomment

by ryanholtdev

0 subcomment

Neat aggregation. One thing worth adding to the feed pipeline: a staleness signal. Several of these sources (threat feeds especially) have update cadences measured in hours, not seconds. Displaying last-updated timestamps per source would help users weight freshness vs. noise when triaging.

by rustyhancock

4 subcomments

There's no data when I tried it on a windows 11 PC. It seemed to install all deps front end is served but dossier says intel unavailable.
No planes etc.
No helpful output in the command window.
Seems fun but doesn't seem to be working.

by laborcontract

3 subcomments

I've seen so many of these in the last week alone.
I need a realtime OSINT dashboard for OSINT dashboards.

by ryanholtdev

0 subcomment

The multi-source aggregation approach is exactly right for this use case -- the value isn't any single feed, it's the correlation between them. Flight diversions, AIS gaps, and social spikes at the same coordinates at the same time tell a very different story than any one of those signals alone.
Curious whether you're doing any timestamp normalization across feeds. Marine AIS in particular can be spoofed or delayed, and correlated analysis gets messy fast if the time windows aren't aligned.

by efromvt

0 subcomment

I'd be interested in just the data layer of this being extractable - will poke around at that. (frontend is fun, though!).

by poemxo

1 subcomments

Why the name Shadowbroker? It sounds a lot like the Shadow Brokers which is the hacker group that stole and published some NSA hacking tools.
Then again they were named after a video game character so it's probably fair.

by coolius

0 subcomment

i wish someone could deploy this somewhere so we can try it out without having to build it first

by anigbrowl

0 subcomment

I’ll admit I leaned way too hard into the "movie hacker" aesthetic for the UI
Nothing wrong with that. Beats a boring corporate dashboard any day. Video game and similar interfaces work for a reason.

by whattheheckheck

0 subcomment

Yoooo this is amazing... can you add rss feeds like feeder.co aggregating subreddits and groundnews articles embedded in here too?
And add chronological feeds of govtrack.us along with all politicians social media feeds

by hettygreen

2 subcomments

This looks really cool..
Let me ask a dumb question. Can this be run on a public server (I use dreamhost) with a web interface for others to see? Or is this strictly something that gets run on a local computer?

by pugworthy

0 subcomment

I was hoping for something like the old Henchman's Helper site, which went offline around 2016-17.
Archive version...
https://web.archive.org/web/20120112012912/http://henchmansh...

by crawfordcomeaux

1 subcomments

I'm excited to see tooling of this nature and scope. Looking forward to seeing similar tooling oriented around all human needs so we can start tracking the meeting of needs to better meet needs, particularly in ways that don't require money.

by cloudez

0 subcomment

Bringing ADS-B, AIS, satellite telemetry, and GDELT into a single local dashboard is a great idea. I’ve already run it in my container environment.

0 subcomment

by garyfirestorm

2 subcomments

> Do not use this tool for any operational, military, or intelligence purpose.
How long before we see this UI in some Iran related news story

by amelius

0 subcomment

Does it show locations of datacenters?

by david_shi

2 subcomments

not knocking this specific implementation in any way, but it's crazy that live OSINT dashboards are now the demo project of choice vs. todo apps

by darkce

0 subcomment

Nice!

by serf

0 subcomment

cool idea.
first llm to stop using those damn colors for every single transparent modal in existence is going to be a big step forward.

by rakag

1 subcomments

    assessment = "ANALYSIS: "

    if any(k in keywords for k in ["strike", "missile", "attack", "bomb", "drone"]):

        assessment += f"{random.randint(75, 95)}% probability of kinetic escalation within 24 hours. Recommend immediate asset relocation from projected blast radius."

    elif...

Lol.

by raised_hand

1 subcomments

Is this hosted anywhere?

by chid

0 subcomment

Did I see this on X first?

by hbarka

1 subcomments

by touchchoice

0 subcomment

Here's my thorough analysis after reviewing the entire project:
---
## Verdict: Not malicious
This is an *OSINT (Open Source Intelligence) dashboard* called "ShadowBroker" that aggregates publicly available real-time data — flights, ships, satellites, CCTV, news, radio, weather, earthquakes, stock markets, and geopolitical events — onto a map. The name references the infamous hacking group but the code itself contains no malware.
---
## What `start.sh` does
1. Checks for Node.js and Python 3 2. Creates a Python venv and installs dependencies from `requirements.txt` 3. Installs npm packages from `frontend/package.json` 4. Runs `npm run dev` which starts both a Next.js frontend and a FastAPI (uvicorn) backend
*No obfuscated commands, encoded payloads, curl/wget to suspicious URLs, reverse shells, or hidden steps.*
---
## What the full codebase does
It fetches data from these *legitimate public sources*:
| Category | Sources | |---|---| | Aviation | adsb.lol (open ADS-B), OpenSky Network (OAuth2) | | Maritime | aisstream.io (AIS vessel tracking) | | Satellites | CelesTrak (NORAD TLEs), SGP4 propagation | | CCTV | TfL London, Singapore LTA, Austin TX, NYC DOT, OpenStreetMap | | News | NPR, BBC, Al Jazeera, NYT, GDACS, NHK RSS feeds | | Radio | Broadcastify (scraping), OpenMHz API | | Weather | RainViewer | | Earthquakes | USGS GeoJSON feed | | Markets | Yahoo Finance (defense stocks, oil) | | Geopolitics | GDELT, Liveuamap (Playwright scraping) |
---
## Things that are NOT present (good signs)
- No data exfiltration — nothing sends your personal data anywhere - No reverse shells or backdoors - No cryptominer code - No encoded/obfuscated payloads - No filesystem scanning or credential harvesting - No network scanning or port scanning - The `subprocess.run` call in `network_utils.py` uses argument lists (not `shell=True`), preventing command injection
---
## Noteworthy concerns (not malicious, but worth awareness)
1. *`cloudscraper` + Playwright stealth* — Used to bypass Cloudflare/Turnstile protections on Liveuamap and OpenMHz. Legally gray (may violate those sites' ToS).
2. *CORS wide open* (`allow_origins=[""]`) in `main.py` — acceptable for a local-only tool, but means any website you visit could make requests to your local backend on port 8000 while it's running.
3. *API key management* — The `/api/settings/api-keys` PUT endpoint writes to `.env` on disk. It does validate against a whitelist of known keys and rejects newlines, but it's exposed without authentication on localhost.
4. *Resource consumption* — The scheduler makes hundreds of outbound API calls per hour from your IP to public services (ADSB, OpenSky, CelesTrak, USGS, RSS feeds, etc.).
5. *UAV data is fake* — `fetch_uavs()` generates simulated drone positions in conflict zones. It's not real tracking data.
6. *Dependencies are all legitimate* — `fastapi`, `yfinance`, `feedparser`, `playwright`, `beautifulsoup4`, `requests`, `sgp4`, etc. are all well-known Python packages. Frontend deps (Next.js, React, MapLibre, Tailwind) are standard.
---
*Bottom line*: Safe to run. It's a hobbyist OSINT dashboard with an edgy name. No malicious behavior detected anywhere in the codebase.

by driverdan

2 subcomments

What's with so many people creating new accounts to promote LLM generated projects? Are they people who don't care about HN and just trying to self promote? Existing users creating new accounts? Lurkers?

by btbuildem

4 subcomments

Lol please at least clean up the markdown diagram -- claude has a real hard time aligning the borders in ascii art for some reason.

by syskuh

0 subcomment

[dead]

0 subcomment

by the_biot

6 subcomments

[flagged]

by hackerbeat

2 subcomments

[flagged]