neatlabs-ai/crucible-sigint: lightweight self-hosted alternative for tinkerers

Passive OSINT Infrastructure Fingerprinting Engine

"One confirmed-bad domain → full infrastructure cluster in under 90 seconds."

Methodology Credit

The foundational analytical approach in CRUCIBLE is directly inspired by the work of Ryan McDonald (Principal Security Engineer | USMC 0341).

Ryan published ["Fingerprinting Malicious Infrastructure Using Free Resources"] (LinkedIn, May 2026), documenting his passive pivot of the DSJ Exchange / BG Wealth Sharing LTD pig-butchering operation — a $150M cryptocurrency fraud that victimized thousands of people, ultimately traced by FBI Operation Level Up with $41M in stolen funds frozen.

Ryan demonstrated — using only free passive sources (crt.sh, urlscan.io, DNS, WHOIS, manual JS inspection) — how a single confirmed-bad domain maps an entire 47-domain criminal infrastructure cluster, identifies on-chain wallet drain mechanisms, and reveals the two-layer brand structure of a large-scale scam operation.

CRUCIBLE automates that methodology. The investigative framework is Ryan's work. This tool is the automation layer built on top of it.

What It Does

CRUCIBLE takes a single seed domain and runs a 7-stage passive pipeline:

12-Signal Threat Scoring Model

Signals are weighted by investigative value. The highest-weight signals (3.0×) represent direct evidence, not inference:

Installation

Requirements: Python 3.10+, 3 packages, no API keys, no accounts.

# 1. Clone
git clone https://github.com/neatlabs-ai/crucible-sigint.git
cd crucible-sigint

# 2. Install dependencies
pip install fastapi uvicorn httpx

# 3. Run
python crucible_app.py

# 4. Open
# http://localhost:8000

The server auto-selects a free port (8000 → 8080 → 8888 → 9000) if your preferred port is in use.

Five Modes

Demo Seeds

These are confirmed domains from documented criminal operations. Run them in Standard mode to see the full pipeline with real data.

APIs Used

All free. No authentication required. No data leaves your machine.

Exports

Every mode exports:

• JSON — full structured report with all signals and raw data
• IOC CSV — domain/IP list, SIEM-ready with source and flag columns
• HTML Report — standalone dark-theme report, no external dependencies
• Copy Findings — plain text for Slack, email, or ticketing systems

All exports support defang toggle — IOCs neutralized with [.] and [://] per TLP conventions before sharing.

Themes

Toggle between dark terminal (default) and paper/light mode using the ☀ button in the top right. Theme preference is saved in localStorage.

Security Design

• No active probing — no exploit payloads, no port scans, no authenticated requests
• All IOC data rendered as inert text — textContent throughout, no innerHTML with external data
• Input validation — strict domain/IP regex before any data reaches the pipeline
• Server-side APIs — no CORS restrictions, no browser sandbox fighting you
• Localhost only — binds to 127.0.0.1, never exposed to your network

Project Structure

crucible-sigint/
├── crucible_app.py        # FastAPI backend — all API calls, scoring, SSE pipeline
├── templates/
│   └── index.html         # Full frontend — 5 modes, 2 themes, all exports
├── requirements.txt       # fastapi, uvicorn, httpx
├── LICENSE                # MIT
└── README.md

Author

Randy B | Security 360, LLC DBA NEATLABS™ 28+ years cybersecurity · USAF Veteran · IRS/DoD practitioner neatlabs.ai

CRUCIBLE SIGINT is for authorized security research, threat intelligence, fraud investigation, and brand protection. Use responsibly.