"Map the surface. Own the signal."
The OPSEC-native OSINT framework — a stealth egress layer under
every module, and an honest per-scan report of exactly what you leaked.
pip install phantomsignal
A single phantomsignal scan orchestrates the entire pipeline — resolving DNS and WHOIS, mapping open ports and services, fingerprinting the technology stack, correlating threat intelligence across dozens of API sources, and crawling the public web surface — then rolls every finding into a single Risk Score and writes a shareable HTML report.
$ phantomsignal scan example.com --profile standard --format html ◈ Target : example.com (domain) ◈ Profile : standard (~2–5 min) ◈ Modules : dns_recon port_scan tech_detect api_hunt web_crawl intel [1/6] DNS & WHOIS ......... 42 records · 7 subdomains [2/6] Port scan .......... 6 open · 22 80 443 8080 … [3/6] Tech fingerprint ... nginx · Cloudflare · React · WordPress [4/6] Threat intel ....... 31 sources queried · 0 malicious [5/6] Web crawl .......... 128 URLs · 3 exposed endpoints [6/6] Scoring ............ Risk Score 34 / 100 (MEDIUM) ◈ Attribution : MASKED — 100% proxied · 0 direct · JA3: chrome124 ✓ Report written → ./reports/example.com.html
PhantomSignal now reports its own attribution surface, closes the vuln loop, orchestrates best-of-breed engines, and runs a deep identity Profiler — all under one stealth egress layer. No other open-source OSINT framework tells you what a scan leaked about you.
Every scan ends with an honest OPSEC grade — masked, partial, or exposed — computed from real egress telemetry: % proxied vs. direct, JA3/JA4 fingerprints presented, WAF challenges, and a per-module breakdown of what's masked vs. traceable to you. The grade is deliberately unflattering.
A shared client under every module: rotating proxy pool, per-host adaptive pacing, sticky browser identity, and optional JA3/JA4 impersonation. Seed the pool in one click from curated free feeds or an uploaded list, watch your posture in the navbar chip, and it all persists across restarts.
The vuln_scan module wraps nuclei, emitting normalised-severity vulnerability findings into the Findings & Exposure view and exporting them as STIX 2.1 Vulnerability SDOs. Active and loud, so it's strictly opt-in — never part of the default sweep.
Optional Go-native tools join the pipeline when installed — subfinder, naabu, katana, tlsx — each inheriting the shared proxy egress and tagged honestly in the attribution report. A binary-free install keeps working: every adapter falls back to its pure-Python module.
Eight new keyless Profiler sources — XposedOrNot breaches (no HIBP key), a GitHub commit-email harvester, GitLab, Wikidata, WebFinger, offline phone metadata, openFEC, and OpenCorporates. Every Profiler run is now saved as a scan with history, summary, and export.
A @register_module / @register_api registry — new recon modules and intel sources join the pipeline by registering, each declaring its OPSEC posture up front so the attribution report always grades a run honestly.
Six intelligence modules. One unified platform.
Scrapy-powered deep crawler. Technology fingerprinting across 50+ stacks — CMS, frameworks, CDNs, WAFs. API endpoint discovery, security header analysis, email and link harvesting.
Full DNS enumeration — A, MX, NS, TXT, SOA, CAA. Zone transfer attempts. Subdomain brute-force plus certificate transparency via crt.sh. SPF/DMARC spoofing analysis.
nmap-powered service & OS detection (-sV -O) with transparent pure-Python async fallback. 99 ports by default, 1 000+ or full 65 535 on demand. Risk-based assessment flags databases, admin panels, and exposed dev services.
54+ integrations: Shodan, VirusTotal, AbuseIPDB, GreyNoise, AlienVault OTX, Intelligence X, and dozens of social/people sources — many keyless. Plugin architecture for custom sources; every network source routes through the stealth layer.
People intelligence from public records — eight keyless sources (breaches, commit-email harvesting, Wikidata, WebFinger, offline phone, and more) cross-correlating emails, phones, socials, and aliases. Every run is saved as a scan; outputs a Risk Score.
JSON, CSV, HTML, PDF, XLSX, STIX 2.1, XML, Markdown. All formats support ZIP compression and AES-256-GCM encryption. Share client-ready reports or feed results into your SIEM.
Three stealth profiles (off / quiet / paranoid) drive per-host adaptive pacing, sticky browser identity, and JA3/JA4 impersonation over a rotating proxy pool — seed it in one click from curated free feeds or an uploaded list. Optional Tor routing. And every run reports exactly what it leaked.
# CLI — set the OPSEC posture per scan phantomsignal scan target.com \ --opsec paranoid \ --format json # Web UI — Settings → Scan Settings Stealth profile : paranoid Proxy pool : Fetch & Add ✓ (curated free feeds) Rotation : sticky · burned egresses auto-benched # Docker — route everything through Tor docker-compose --profile covert up -d # Navbar chip shows live posture: 🕶 PARANOID · pool 42 · JA3 on
Every scan produces a Risk Score (0–100) — a weighted composite of open ports, vulnerability findings, missing security controls, and threat intelligence flags.
# Install from PyPI pip install phantomsignal # Initialize database phantomsignal init # Launch web UI phantomsignal web --open-browser # → http://127.0.0.1:5000 # Or scan straight from the CLI phantomsignal scan example.com
git clone https://github.com/getphantomsignal/phantomsignal cd phantomsignal docker-compose up -d # Open http://localhost:5000
git clone https://github.com/getphantomsignal/phantomsignal cd phantomsignal python -m venv .venv source .venv/bin/activate # Windows: .venv\Scripts\activate pip install -e . phantomsignal web --open-browser # Open http://127.0.0.1:5000
# IP recon — nmap version + OS detection, GeoIP, panels phantomsignal scan 192.168.1.1 --type ip_recon # Domain recon, quiet OPSEC posture, HTML report phantomsignal scan example.com \ --profile standard --opsec quiet \ --format html --output ./reports # People intelligence phantomsignal profile \ --email target@example.com \ --first-name John --last-name Doe # Extend with API keys for Shodan, VT, AbuseIPDB... phantomsignal config --list-apis
⚠ For authorized use only. See the Legal & Ethics section before running any scan.
A whole tier works with zero API keys — add your own in Integrations to go deeper. Every network source routes through the stealth egress layer.
Open-source. MIT licensed. No telemetry. No phone-home. Your recon stays on your machine.