Three OSINT tools, installed and put through their paces. Notes on what each one actually does.
Not my software. These are three open-source tools by other people, found via a reel that named none of them and gated the links behind a comment-for-DM prompt. I identified them from the terminal frames, installed all three, and ran them. This page is the reference I wanted and didn't get: real repo links, install commands that work, and an honest account of which claims survive contact.
Everything lives in ~/tools/osint/, each in its own uv venv pinned to Python 3.12. Python 3.14 breaks several dependencies.
One email address in, a structured identity report out. It fans out across breach corpora, social platforms, DNS, git commit metadata and the open web, then clusters the hits into candidate identities with an explicit confidence band on each.
# greenlet is a missing dependency in 0.14.3 - install it explicitly
pip install mailaccess greenlet
mailaccess investigate you@example.com
mailaccess investigate you@example.com -o report.pdf
greenlet, so the backend dies on startup. Worse, the CLI prints a failure message and then exits 0, despite its own docs promising exit code 3 for that case. In a script it fails silently. Installing greenlet alongside it fixes the whole thing.Start at one onion address and crawl outward. Returns a searchable tree of every linked site with page titles, HTTP status, a rough category, and any emails or phone numbers scraped along the way. The point is that you read a file afterwards instead of clicking through anything yourself.
git clone --depth 1 https://github.com/DedSecInside/TorBot.git
cd TorBot && uv venv .venv --python 3.12
uv pip install --python .venv/bin/python -r requirements.txt
uv pip install --python .venv/bin/python -e .
# Tor must be listening on 9050 first
brew install tor
/opt/homebrew/opt/tor/bin/tor --SocksPort 9050 --DataDirectory ~/tools/osint/tor-data
.venv/bin/python main.py -u <onion-url> --depth 1 --visualize table
.venv/bin/python main.py -u <onion-url> --depth 2 --save json
--disable-socks5, which defeats the entire point.brew services start tor silently did nothing on macOS 26. Running the binary directly bootstrapped a circuit to 100% in about five seconds.Sold as twenty investigation lookups in one terminal program: phone numbers, Wi-Fi geolocation, crypto wallet tracing, Sherlock. The program runs. Almost none of that is reachable without paying for it first, and some of it does not exist at all.
git clone --depth 1 https://github.com/6abd/horus.git
cd horus && uv venv .venv --python 3.12
uv pip install --python .venv/bin/python -r requirements.txt
# must be run from the horus dir - it reads api_config.json by relative path
.venv/bin/python horus.py -numlook
api_config.json. The only modules that run keyless are the Loki local-encryption utilities and the two VPN wrappers, none of which are OSINT. The advertised functionality is entirely paywalled behind seven-plus separate API registrations.numlook fails with the bare string FAILURE: 'valid', a KeyError from an unauthenticated API response. The modules set sys.tracebacklimit = 0, so nothing useful ever surfaces.Dischook, Leverage and Casegenerate all print in the menu but are commented out of the argument parser. Calling any of them returns error: unrecognized arguments.Leverage - which is one of the commands that does not exist. There is no Sherlock integration.lokigen generated a key without complaint. The shell works; the contents mostly do not.All three were presented as equivalent. One is a solid tool with a packaging bug, one does what it says, and one is a menu.