🔬 FORENSIC INTELLIGENCE PLATFORM

The Intelligence Machine

It started as a single HTML file. A list of attackers.
It became a full forensic pipeline — honeypot to evidence, evidence to investigation, investigation to published article — with every piece of data vectorized, cross-linked, and searchable in milliseconds. 115,601 vectors. 21 Qdrant collections. 3 PostgreSQL databases. 14 autonomous CronJobs. One machine.

115,601
Total Vectors
928
Investigations
10,941
Evidence Items
17,237
Entity Crosslinks
8,395
OSINT Library Chunks
2.1M+
Database Rows
21
Qdrant Collections

It Began as a Problem

The first threat intelligence dossier was a block of HTML hand-spliced into a monolithic page. Editing meant counting divs. Publishing meant a grep and a copy. Linking evidence meant trusting memory. That wasn't a methodology — it was archaeology in reverse.

1

The Monolith

A single threat-intel.html file containing every published dossier as raw HTML sections. No structure. No queryability. No versioning beyond manual git commits. Dossiers 001–025 still live there — a museum of the before.

One fileHand-edited HTMLDossiers 001–025
2

The Publisher API

A REST API that decoupled content from structure. Each dossier became a database record: slug, title, HTML content, scoped CSS, series order, navigation position. Publishing became a POST request. The nav rebuilt itself. Every page regenerated from a single source of truth. AI agents can now write Markdown and the pipeline auto-converts to themed, styled articles — no raw HTML required.

REST APIJinja2 templatesAuto-nav rebuildMarkdown→HTML10 theme presets369 pages
3

The Investigation Store

The articles were the visible surface. What they rested on was the real work: a structured dossier_intel PostgreSQL database holding every actor, finding, evidence item, infrastructure node, and connection that fed each published report. Nothing published without a citation. Nothing cited without a source URL.

PostgreSQLActors · Findings · EvidenceInfrastructure · ConnectionsArtifacts on disk
4

The OSINT Library

8,375 NLP-enriched chunks from court filings, WikiLeaks cables, sanctions lists, ODNI reports, dark web takedown records, and corporate surveillance documents. Fed through FSCrawler into Elasticsearch, then embedded into Qdrant via bge-m3. Every investigation can now cite a DOJ indictment or a WikiLeaks cable with a real source URL — not a paraphrase.

ElasticsearchFSCrawlerNLP entities8,375 chunksbge-m3 embeddings
5

The Vectorization Layer

Everything that existed — published articles, evidence, actors, findings, infrastructure nodes, connections, investigation summaries, OSINT library chunks — got embedded into Qdrant. Not a backup. A live semantic index. Any AI agent can now ask "what else is connected to this IP?" and traverse 17,237 entity crosslinks across 21 collections in one call.

21 Qdrant collections115,601 vectorsEntity crosslinksHybrid search
6

The Web Threats Layer

The honeypot watched SSH. But what was hitting the HTTP surface? Traefik logs, CrowdSec L7 decisions, and MikroTik L3 ban lists sat in separate systems with no unified intelligence. A new API, database, and indexer pulled them together: 7,485 IP profiles, 36 campaigns, 95 ASN threat profiles, 1M+ CrowdSec decisions — all searchable, all linked into the same Qdrant graph as the honeypot and the dossiers.

Traefik HTTP logsCrowdSec L7MikroTik L37,485 IP profiles36 campaigns

What It's Made Of

Each layer feeds the next. None of them require cloud. All of them run on one machine in Iași, Romania.

🪤
Honeypot Engine
Cowrie SSH honeypot captures every session: credentials, commands, downloads, HASSH fingerprints, SSH key sharing. Streamed into PostgreSQL threat_intel in real time. Enriched hourly with RDAP, Cymru BGP, Shodan, GreyNoise, OTX, VirusTotal, Censys, DShield, IPInfo.
9,984 IP threat profiles · 57 detected campaigns · 132K+ entity links
🔬
Investigation Store
PostgreSQL dossier_intel holds every forensic artifact: actors with institutional anchors, findings with confidence levels, evidence with source URLs, infrastructure nodes, connection graphs, and investigation timelines. 817 investigations. 279 published.
10,941 evidence items · 3,383 findings · 5,073 connections · 3,483 infrastructure nodes
📚
OSINT Library
8,375 NLP-enriched chunks from primary sources: DOJ indictments, WikiLeaks Spy Files, ODNI reports, OFAC sanctions, dark web takedowns, corporate surveillance documents. Each chunk has noun phrases, named entities (PERSON/ORG/GPE/LAW), and domain hints. Embedded with bge-m3.
8,375 chunks · Court filings · WikiLeaks · Sanctions · Intel reports
📡
Publisher Pipeline
REST API that converts database records into published HTML pages. Each dossier has scoped CSS, proper nav position, series grouping, SEO metadata, bidirectional sync with the investigation store. One publish call rebuilds every page, the nav index, and the sitemap.
369 published dossiers · 4,097 content chunks indexed
🌐
Web Threats Intelligence
Traefik HTTP logs, CrowdSec L7 ban decisions, and MikroTik L3 address lists unified into a single intelligence layer. Enriched with RDAP, ASN data, behavioral classification. Campaign detection across HTTP patterns. Same query interface as the honeypot.
7,485 IP profiles · 36 HTTP campaigns · 1M+ CrowdSec decisions
🧠
Qdrant Vector Memory
21 collections, 115,601 vectors, all embedded with bge-m3. Honeypot IPs, dossier findings, published article chunks, OSINT library documents, entity crosslinks — all in one semantic graph. Any AI agent can traverse the entire intelligence picture in a single query.
20 collections · 105,707 vectors · 16,050 entity crosslinks
🤖
MCP Tool Layer
383 MCP tools spanning infrastructure management, intelligence queries, dossier operations, honeypot analysis, web threat searches, OSINT library retrieval, and publisher operations. Any connected AI agent inherits the full investigation stack as callable functions.
383 tools · Honeypot · Dossier · Web threats · Publisher · Kubernetes · Security
🔄
Automated Enrichment
Fourteen CronJobs run without intervention: hourly first-pass enrichment, 4×/day deep enrichment (Shodan, AbuseIPDB, OTX, VirusTotal, Censys, DShield, IPInfo), bi-hourly entity linker, hourly web threat scraping + autoban, tri-hourly dossier indexing, daily OSINT feed sync, active recon via Tor-routed nmap, weekly threat reports, and continuous CrowdSec→MikroTik defense coordination.
14 CronJobs · Fully autonomous · Zero manual enrichment · Hourly enrichment cycles

From Raw Attack to Published Intelligence

Every dossier on this site follows the same chain. Nothing published without passing through every layer.

Layer 0 — Capture
🪤 Cowrie Honeypot + Traefik + CrowdSec + MikroTik
SSH sessions, HTTP request logs, L7 decisions, L3 firewall bans — raw evidence
Layer 1 — Enrich
⚙️ RDAP · Cymru · Shodan · GreyNoise · OTX · VirusTotal · Censys · DShield · IPInfo
IP → ASN → organization → behavior classification → entity links (132K+ edges)
Layer 2 — Investigate
🔬 Dossier Store · OSINT Library · Web Search · Pentesting Tools
Actors, findings, evidence with source URLs, infrastructure graph, connections — all structured
Layer 3 — Vectorize
🧠 bge-m3 → Qdrant (21 collections · 115K+ vectors)
Every entity embedded: semantic search across honeypot, dossiers, OSINT library, web threats
Layer 4 — Publish
📰 Markdown → Themed HTML+CSS → Publisher API → shuffle-on.com/threat-intel/
AI writes Markdown, converter applies subject-appropriate theme (10 presets), model validators sanitize content, one-call publish rebuilds all 369 pages

Three PostgreSQL Databases. 2.1 Million Rows.

Each database has a distinct role. No single system holds everything. They feed each other through enrichment jobs, entity linkers, and the indexing pipeline.

🪤
threat_intel
The raw intelligence store: 47 tables, 894K+ rows. Honeypot sessions (39K), credentials (146K), SSH fingerprints (129K), IP enrichments from 12+ OSINT sources, deep enrichment logs, entity links (132K), ASN registrations, port histories, SSH key sharing graphs, active scan results.
894K+ rows · 47 tables · 132K entity links · 12+ enrichment sources
🔬
dossier_intel
The investigation store: structured forensic artifacts from 928 investigations. Every actor (2,201), evidence item (10,941), finding (3,383), infrastructure node (3,485), and connection (5,073) is typed, confidence-rated, and traceable to source URLs. Published dossiers (369) sync from here to the live site.
26K+ rows · 928 investigations · 369 published · 10,941 evidence items
🌐
web_threats
HTTP-layer threat intelligence: 1M+ CrowdSec L7 decisions, 132K requests analyzed, 7,485 IP profiles enriched, 5,026 MikroTik firewall bans, 36 auto-detected campaigns, behavioral attack patterns, and ASN risk statistics — all from live Traefik/CrowdSec/MikroTik telemetry.
1.19M rows · 1M+ CrowdSec decisions · 7,485 IP profiles · 36 campaigns

18 Collections. One Semantic Graph.

Every data type gets its own Qdrant collection, with filtered search indexes. Entity crosslinks bridge them: a finding in a dossier links to an IP in the honeypot links to an ASN in web threats links to a court filing in the OSINT library.

Collection Domain Vectors Contents
dossier_findingsInvestigations3,352Analytical conclusions with confidence, severity, category
dossier_evidenceInvestigations9,573Sourced evidence items — every claim traceable to a URL
dossier_actorsInvestigations2,180Actors and entities with type, risk, country, institutional anchors
dossier_infrastructureInvestigations3,483IPs, ASNs, domains, hosting providers used by tracked actors
dossier_connectionsInvestigations5,042Relationship edges between entities — directional, typed, confidence-rated
dossier_publishedInvestigations4,097Published article content chunks — search across actual dossier text
dossier_investigationsInvestigations918Investigation summaries and metadata — find related cases
dossier_osint_libraryOSINT Library8,375Court filings, WikiLeaks, sanctions, intel reports, dark web takedowns
honeypot_ipsHoneypot9,978Full IP threat profiles — behavior, enrichment, attribution, campaigns
honeypot_asnsHoneypot2,059ASN-level risk profiles — country, bulletproof status, attack volume
honeypot_orgsHoneypot1,738Organization threat profiles — hosting patterns, operator clustering
honeypot_campaignsHoneypot57Detected coordinated attack campaigns — IPs, timing, shared signatures
honeypot_sessionsHoneypot1,231SSH session intelligence — command patterns, HASSH clusters, tooling
honeypot_actorsHoneypot14HASSH-based actor cluster profiles
web_threats_ipsWeb Threats7,479HTTP-layer IP profiles — Traefik patterns, CrowdSec bans, MikroTik blocks
web_threats_campaignsWeb Threats36Auto-detected HTTP attack campaigns — shared paths, timing, signatures
web_threats_asnsWeb Threats95ASN risk profiles from the HTTP observation point
entity_crosslinksGraph16,050Auto-generated edges connecting honeypot ↔ dossiers ↔ web threats ↔ OSINT library
105,707
Total Vectors
21
Collections
16,050
Crosslinks
132K+
Entity Links
817
Investigations
369
Published

How an Investigation Actually Works

Every published dossier follows the same seven-layer methodology. Not because a framework said so — because each layer catches what the others miss.

1 · Technical
Honeypot sessions, threat_intel PostgreSQL, HASSH fingerprints, SSH key sharing, ASN/BGP/RDAP registration chains, Shodan banners, certificate histories.
2 · Surveillance Market
NSO Group, Cellebrite, Kape Technologies, Bright Data CSV ecosystem — the commercial layer that makes state-level surveillance possible without state-level skills.
3 · Proxy Economy
How the infrastructure connects to the proxy/VPN market — Bright Data SDK integration, Socks5Systemz, residential proxy resellers. The money trail behind the routing.
4 · Information Warfare
Propaganda infrastructure, Doppelgänger operations, troll farm structures, RAND firehose-of-falsehood doctrine. The narrative layer that outlasts the technical attack.
5 · Electromagnetic / IoT
IMSI catchers, 5G mesh vectors, IoT botnet recruitment — how physical-layer infrastructure bleeds into the cyber domain.
6 · Social Manipulation
Cambridge Analytica methodology, psychographic targeting, platform weaponization patterns. The human vulnerability surface that technical controls don't touch.
7 · Historical Context
Operation Gladio, Condor, Bernays, Tavistock, Five Eyes history. Current operations rarely invent — they inherit. The OSINT library contains the primary sources.

Before publishing, the strongest alternative explanation is generated. If the evidence doesn't survive its own counter-narrative, the dossier isn't ready.

Quality gate applied to all 279 published investigations

The Platform as Instant Memory

The vectorization wasn't built for search. It was built so that any connected AI model inherits 115,601 vectors of forensic context the moment it connects — no retrieval prompt engineering, no manually curated examples.

🔌
383 MCP Tools 📸
Any MCP-compatible agent — Claude, Copilot, local Ollama models — connects to a server with 383 callable tools: honeypot queries, dossier writes, publisher operations, Kubernetes management, threat enrichment, network scanning, OSINT library retrieval. The model doesn't need to know the schema.
📖
Toolkit + Skills
A mounted /dossier-toolkit directory of structured documentation — methodology guides, database schemas, publishing workflows, investigation principles — loaded by dossier_guide(topic). The AI reads the actual operating manual, not a cached version of it.
🗃️
Artifacts on Disk
Every investigation generates structured artifacts: db-payload.jsonl (audit log of all writes), category dumps (actors, evidence, findings), raw research notes. Mounted into the MCP server. Persistent across sessions. The AI's work survives restarts.

The goal wasn't to make AI useful for threat intelligence. It was to make 115,000 vectors of forensic context available to whatever AI model asks for them — without rebuilding the pipeline for each model.

Architecture decision — December 2025

Everything Connected to This Platform

The dossiers are the published surface. The platform is what makes them defensible.