An OSINT case laid out as a graph of linked entities
Flowsint is a reconnaissance and OSINT tool that puts every lead in an investigation on a graph: a domain, an IP, an email, a username, a company, a phone number or a crypto wallet each becomes a node. Enrichers grow the graph. Each one takes an entity, pivots to new ones through a DNS lookup, a WHOIS query, a command-line scanner or a third-party API, and adds what it finds as fresh nodes. The analyst follows the links on a canvas instead of stitching together output from tools that never talk to each other.
45 documented pivots and flows you can rerun
- Enrichers sorted by entity type. The documentation's catalog lists 45 of them in eleven categories: subdomains from subfinder with crt.sh as a fallback, a username's social accounts from Sherlock or Maigret, an email's breaches from Have I Been Pwned or DeHashed.
- Flows turn a method into something repeatable. A flow chains enrichers from one entity type, so one enricher's output becomes the next one's input. Once saved, it reruns on any entity of that type and writes a JSON log for every run.
- Recon binaries ship inside the image. subfinder, asnmap, dnsx, naabu, httpx and jq live in the container, not on the host.
- Custom enrichers are ordinary Python. The backend (FastAPI, Celery) is Python and the UI TypeScript. A new enricher goes in the
flowsint-enrichersmodule and registers itself with a decorator.
Infrastructure maps, WHOIS history and Ethereum tracing
- Map an organization's footprint: its ASNs, their CIDR ranges, the IPs inside them and the domains pointing at those IPs.
- Pull a domain's WHOIS history along with the people, companies and email addresses named in it.
- Trace an Ethereum wallet's transactions and the wallets it trades with.
Six containers, outbound API calls and an early-stage codebase
Flowsint runs as six Docker containers: PostgreSQL, Redis, Neo4j, the API, a Celery worker and the frontend, pulled as prebuilt images from GitHub Container Registry. There is no default account; the first user signs up on the registration page. The README says all data stays on the local machine.
Opening an instance to a team takes manual hardening. By default nginx.conf accepts only localhost and loopback addresses, as a guard against DNS rebinding. For a shared server, the README asks for three new secrets in .env, including the Neo4j password (password out of the box), and the server's hostname in the allowlist. Beyond a trusted LAN, it recommends an HTTPS reverse proxy in front of port 5173, the only port exposed.
Enrichers call out from the machine that runs them. The documentation warns that thousands of requests to one service can get the user banned or flagged. Port scans default to ProjectDiscovery's passive database; active mode probes the target directly. Part of the catalog needs a third-party API key (Have I Been Pwned, DeHashed, Whoxy, Etherscan and others), stored in an encrypted vault.
Company registry lookups cover France only. The enrichers that find a person's companies or an organization's executives query SIRENE, the INSEE business register, and the code says so in plain words: "France only".
ETHICS.md names the intended users: security researchers and analysts, journalists and OSINT investigators, law enforcement and fraud teams, and in-house threat intelligence. It rules out unauthorized intrusion, surveillance and doxxing; the Apache 2.0 license itself places no restriction on use.
The code has been Apache 2.0 since 25 January 2026, and AGPL-3.0 before that. ETHICS.md says earlier contributions were relicensed with written consent from every contributor. Release 1.2.12, on 26 August 2026, then dropped four GPLv3 dependencies.
The README still describes early development, although 1.0.0 shipped in December 2025. Version 1.2.13, out on 3 October 2026, is the eighth release since February, and the last commit is from 18 October 2026. The README calls its own test suites incomplete. The docs, last updated on 15 May 2026, still carry version 1.2.8; their catalog lists 45 enrichers where the README's list stops at 30.