A high-performance OSINT tool for visualizing and mapping threat actor IPs on an interactive dark-themed map. Features offline geolocation via MaxMind GeoLite2 and real-time enrichment via ipinfo.io.
Compared to standard IP mapping tools, this version includes significant enhancements:
- 🌐 Instant Multilingual Support: Switch between English and Spanish instantly without page reloads.
- 🛡️ Persistent Configuration: Uses
.envfiles to store your API tokens securely—no more manual entry on every startup. - 🕵️ Extended Actor Intelligence: Integrated search with
threatactorusernames.comto cross-reference actors across multiple dark web forums. - 🌍 Advanced Visualization:
- High-performance marker clustering for massive datasets.
- Interactive side panel with flag icons, ISP details, and mini-maps.
- Automatic deduplication (one pin per unique IP/Actor pair).
- 🔍 Real-time Search: Autocomplete username search with IP count previews.
- 📱 Responsive Dark UI: Optimized for high-resolution screens with a modern, glass-morphism aesthetic.
git clone https://github.com/Ivancastl/darkforums-ip-intel.git
cd darkforums-ip-intelpip install -r requirements.txt- Get a free token at ipinfo.io (50,000 free requests/month).
- Create a
.envfile in the root directory:IPINFO_TOKEN=your_token_here
If no token is provided in .env, the app will prompt you at startup or run in limited mode.
python flask_app.pyOpen your browser to: http://127.0.0.1:5000
- Backend: Python / Flask
- Frontend: Vanilla JavaScript (ES6+), Leaflet.js, MarkerCluster
- Data: MaxMind GeoLite2 (Offline), ipinfo.io (Enrichment), threatactorusernames.com (Actor Intel)
- Environment: python-dotenv
- Your
.envfile is automatically ignored by Git to prevent accidental token exposure. - All IP lookups are performed through secure HTTPS requests.
MIT