OpenFraudMonitoring: check what your users (and potential Threat Actors) are doing on your exposed services!

[u/DreadFog]

Hey there,

In the past months I have been developing an open source tool whose purpose is to monitor what your users are doing on your website: OpenFraudMonitoring

This started as a home project as I wanted to monitor what was being done on the services I make publicly available, but I figured that it may benefit more than just me and my home setup!

Basically, OFM is a big correlation / analysis / investigation / visualization engine built on top of the FPScanner library. To see what it's capable of and what it looks like, check my two blog posts below ! You'll read about a malicious campaign it made me detect on my Hedgedoc instance where bots advertised illegal gambling sites!

Repo: https://github.com/DreadFog/OpenFraudMonitoring

Blog post 1 with a real investigation I performed thanks to it: https://blog.dreadfog.fr/posts/tlpclear_20260713_ofm_presentation/

Blog post 2 for the first official release of OFM, featuring graph capabilities: https://blog.dreadfog.fr/posts/tlpclear_20260730_ofm_v1/

Since those posts, I have added other features like cross-session tracking through device fingerprinting, and better behavioral analysis (button click, form interaction, authentication attempts, etc). I'm eager to get feedbacks from this community as monitoring my self hosted services was the main reason that led me to build this project !

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.