Open source OSINT automation tool that gathers data on IPs, domains, emails and more from 200+ sources for threat intelligence and attack surface mapping.
reconurge/flowsint
Open-source graph-based OSINT investigation platform that links entities like domains, IPs, emails and wallets through automated enrichers.
Open-source alternative to:Maltego
- Stars
- 9,846
- Forks
- 1,224
- Open issues
- 67
- Last commit
- yesterday
What is it?
Flowsint is a visual investigation tool for reconnaissance and open-source intelligence work. Analysts place entities such as domains, IP addresses, ASNs, organizations, emails and crypto wallets on a graph and explore how they relate to each other.
Entities are expanded with built-in enrichers that run lookups such as reverse DNS, subdomain discovery, WHOIS, ASN and CIDR mapping, website crawling, email breach checks, Gravatar lookup, username search via Maigret, and wallet transaction history. An N8n connector is also included for hooking into workflows.
The platform runs locally through Docker, using PostgreSQL, Redis and Neo4j for storage, and includes a FastAPI backend and a TypeScript frontend. Stored API keys are encrypted with a vault key, and the project publishes ethical use guidelines alongside its Apache-2.0 license.
Key features
- 01Visual graph canvas for mapping relationships between entities
- 02Built-in enrichers for domains, IPs, ASNs, emails, phones and wallets
- 03Username search across social platforms via Maigret
- 04Encrypted storage for API keys
- 05Docker-based setup with Linux, macOS and Windows instructions
Use cases
- Mapping a company's domains, subdomains and IP ranges during a security assessment
- Tracing links between email addresses, usernames and online accounts in an OSINT investigation
- Following cryptocurrency wallet transactions and related NFTs
- Running a self-hosted investigation workspace for a small team
Quick start
- 1
Install prerequisites: Docker and Make (Linux/macOS)
- 2
Clone the repository
git clone https://github.com/reconurge/flowsint.git - 3
Enter the project folder and run the install command
cd flowsint && make prod - 4
Open http://localhost:5173/register and create an account
Things to know
- Early development stage; the README says it still needs community help.
- Test suites are described as incomplete.
- Some enrichers depend on external data sources, so results depend on those services.
- Requires Docker and runs several services (PostgreSQL, Redis, Neo4j, API), which is heavy to self-host.
Topics
FAQ
- What is flowsint?
- Open-source graph-based OSINT investigation platform that links entities like domains, IPs, emails and wallets through automated enrichers. Flowsint is a visual investigation tool for reconnaissance and open-source intelligence work. Analysts place entities such as domains, IP addresses, ASNs, organizations, emails and crypto wallets on a graph and explore how they relate to each other.
- Is flowsint free to use? What license does it have?
- flowsint is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
- Is flowsint still maintained?
- Actively maintained. The last commit to flowsint was on Oct 18, 2026.
- What can I use flowsint for?
- Mapping a company's domains, subdomains and IP ranges during a security assessment Tracing links between email addresses, usernames and online accounts in an OSINT investigation Following cryptocurrency wallet transactions and related NFTs Running a self-hosted investigation workspace for a small team
- How do I install flowsint?
- Install prerequisites: Docker and Make (Linux/macOS) Clone the repository: git clone https://github.com/reconurge/flowsint.git Enter the project folder and run the install command: cd flowsint && make prod Open http://localhost:5173/register and create an account
- Where can I get flowsint?
- The source code and installation instructions are on GitHub: https://github.com/reconurge/flowsint
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A Go CLI that queries multiple internet search engines (Shodan, Censys, FOFA, ZoomEye and more) to find exposed hosts, with output designed for piping into other tools.
All-in-one open source intelligence tool that runs on-demand checks on any website, covering DNS, SSL, headers, server info and security configuration.
AI-powered OSINT tool that searches dark web engines through Tor, uses an LLM to refine queries and filter results, and writes an investigation summary.
Self-hosted web page change monitor that alerts you via Discord, Email, Slack, Telegram, webhooks and more when a page changes.
Cross-platform terminal and web system monitor for CPU, memory, disk, network, processes and containers, with a REST API and exports.