From a list of attackers to a machine that remembers.
It started as one hand-edited HTML file. It became a pipeline: every attack captured, enriched, investigated, linked and searchable by meaning — on one machine, with local models.
Figures refresh from the live system every 30 minutes.
It began as a problem.
The first dossier was a block of HTML pasted into one giant page. Editing meant counting divs. Linking evidence meant trusting memory.
That wasn't a method. So, one layer at a time, it became one.
- The monolith
One file, every dossier as raw HTML. Dossiers 001–025 still live there — a museum of the before.
- The publisher
Each dossier became a database record. Publishing became one call; the navigation rebuilds itself. AI writes Markdown, the pipeline themes it.
- The investigation store
Every actor, finding, evidence item and connection behind a report, structured. Nothing published without a citation.
- The OSINT library
Court filings, sanctions lists, intelligence reports and leaked cables — split, enriched and embedded, so a claim can cite a primary source.
- The memory
Everything embedded into one vector store. Ask "what else is connected to this?" and get the answer across every layer at once.
- The web sensors
HTTP traffic, blocking decisions and router bans joined the same graph as the honeypot and the dossiers.
Eight parts, one picture
Each part feeds the next. None of them needs a cloud.
Honeypot engine
An SSH honeypot records every session: logins, commands, downloads, client fingerprints. Streamed into the database as it happens.
10,787 attackers · 65 campaignsWeb sensors
Gateway logs, application-layer blocks and router bans, unified and classified by intent — scrapers, scanners, credential harvesters, AI crawlers.
60,497 IPs · 177 countries · 748 campaignsEnrichment
Every address is profiled from public sources: registration, network ownership, reputation, exposed services. Automatically, around the clock.
31,590 addresses enrichedInvestigation store
Actors, findings with confidence levels, evidence with source links, infrastructure and connections — typed and traceable.
4,156 actors · 8,666 findingsOSINT library
Primary sources, enriched with people, organisations, places and laws, so investigations quote documents rather than paraphrase them.
38,159 documents · 89,824 passagesVector memory
One semantic graph across honeypot, dossiers, library and web threats. Any AI agent can walk the whole picture in a single query.
1,290,931 vectors · 26 collectionsIntelligence linker
Finds what ties addresses together — shared networks, timing, contacts, domains, malware — and writes it into the graph.
691,880 relationshipsPublisher
Turns finished investigations into themed pages with navigation, SEO and a verification page each. One call rebuilds the lot.
817 dossiers publishedFrom raw attack to published intelligence
Every dossier passes through all five layers. No shortcuts.
- CaptureSSH sessions, HTTP requests, blocking decisions — raw evidence.556,803 sessions
- EnrichAddress → network → organisation → behaviour → links.31,590 profiled
- InvestigateActors, findings and sourced evidence, structured.1,997 cases
- VectorizeEverything embedded and linked across layers.206,089 crosslinks
- PublishMarkdown → themed page → live site, with a verification page.817 dossiers
Three databases, three jobs
No single system holds everything. Enrichment jobs and the linker keep them talking.
What the sensors saw
Honeypot sessions, credentials tried, client fingerprints, enrichment results and the relationship graph.
638,258 login attempts · 3,735 SSH keysWhat it means
Every case, actor, finding and evidence item — confidence-rated and linked to its source. Published dossiers sync from here.
24,121 evidence · 14,914 connectionsWhat hit the front door
HTTP-layer profiles, campaigns, network risk statistics and the blocking decisions they triggered.
60,497 IPs · 242 also in the honeypot26 collections. One semantic graph.
A finding in a dossier links to an address in the honeypot, to a network in the web sensors, to a court filing in the library.
| Collection | Layer | What it holds | Vectors |
|---|---|---|---|
| Findings | Investigations | Conclusions with confidence and severity | 8,666 |
| Evidence | Investigations | Sourced items — every claim traceable | 24,121 |
| Actors | Investigations | People and organisations, typed and risk-rated | 4,156 |
| Infrastructure | Investigations | Addresses, networks, domains, hosting | 4,934 |
| Connections | Investigations | Directed, typed relationship edges | 14,914 |
| Published text | Investigations | Passages of the published dossiers | 8,969 |
| OSINT library | Library | Primary-source passages | 89,824 |
| Address profiles | Honeypot | Behaviour, enrichment, attribution | 91,196 |
| Sessions | Honeypot | Command patterns and tooling | 16,435 |
| Campaigns | Honeypot | Coordinated attack groups | 85 |
| Web addresses | Web threats | HTTP-layer profiles | 60,656 |
| Web campaigns | Web threats | Shared paths, timing and signatures | 746 |
| Crosslinks | Graph | Edges joining every layer | 206,089 |
A selection of the collections; counts are live.
How an investigation actually works
Seven lenses. Each catches what the others miss.
The platform as instant memory
Any connected AI model inherits the whole forensic context the moment it connects. No prompt tricks, no hand-picked examples.
The local models run on the lab's own AMD Radeon AI PRO R9700 (32 GB) through one llama.cpp router — Qwen3.5-9B for the everyday work, Qwen3.6-27B for the heavy reasoning.
Honeypot queries, dossier operations, publishing, library retrieval and cluster tools — plus 41 security-operations tools. The model never needs the schema.
Methodology, schemas and publishing workflows the AI reads on demand — the actual manual, not a cached memory of it.
Every investigation leaves structured artifacts and an audit log of its writes. Restarts lose nothing.
Everything this platform produces
Want to see it work on a real case?
Researchers, journalists and defenders are welcome to ask for a walkthrough or access to the intelligence.