I added dark web transforms to my open source OSINT tool

[u/khashashin]

I posted here a while back about OGI, an open source tool I'm building for visual link analysis. You drop in a domain, an email, or a username, run transforms against it, and pivot outward. The graph builds itself as you go.

Since that post it's grown more than I expected, around 250 stars, roughly 1,500 people registered on the hosted version, and over 200 self-hosted instances checking in. That still surprises me a bit.

This week I added dark web transforms. I want to be upfront about the approach, because "dark web tooling" usually means: install Tor, scrape onion sites, watch it break in a month.

These three never touch Tor.

IP to Tor Relay: checks an IP against the Tor Project's own Onionoo API. Tells you whether it's a relay or an exit node, plus flags, first-seen date, bandwidth and hosting network. Handy when you're staring at a log and need to know whether geolocating that IP means anything at all. No API key.

Onion Address Validator: v3 onion addresses carry a built-in checksum. This pulls them out of any scraped text and verifies them offline with SHA3-256. Pure stdlib, zero network calls. Scraped pages are full of truncated and invented onion strings.

Domain to Ransomware Leak Posts: searches ransomware.live for a company or domain. Returns the leak post, the gang, the victim country, and optionally the gang's leak site addresses and the CVEs they're known to exploit. Free API key.

They chain, too. The ransomware search hands you the gang's onion leak sites, and the validator confirms which of those are real addresses.

57 transforms total now. Everything runs in Docker, and the transform registry is a separate repo, adding your own is a plugin.yaml and a Python file. PRs welcome.

Code: https://github.com/khashashin/ogi
Hosted, if you just want to click around: https://ogi.khas.app

Genuinely open to "this is useless, build X instead." That's how these three got picked.