██████╗ █████╗ ██████╗ ██████╗ █████╗ ███╗ ██╗ █████╗ ███╗ ██╗ █████╗
██╔══██╗██╔══██╗██╔══██╗██╔══██╗██╔══██╗████╗ ██║██╔══██╗████╗ ██║██╔══██╗
██████╦╝███████║██║ ██║██████╦╝███████║██╔██╗ ██║███████║██╔██╗██║███████║
██╔══██╗██╔══██║██║ ██║██╔══██╗██╔══██║██║╚██╗██║██╔══██║██║╚████║██╔══██║
██████╔╝██║ ██║██████╔╝██████╔╝██║ ██║██║ ╚████║██║ ██║██║ ╚███║██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚══╝╚═╝ ╚═╝
R E S E A R C H C O L L E C T I V E
Independent security research · OSINT tooling · CIB investigations
Independent research operation running three tracks:
Investigations — Coordinated inauthentic behavior networks, malware distribution campaigns, browser extension abuse. Findings disclosed responsibly, documented publicly.
Tooling — Open-source infrastructure for OSINT, detection engineering, and security research. Terminal-native. Built to compose.
Analysis — Published writeups on threat actor methodology, internet culture, and tool teardowns.
| Repo | Description | Status |
|---|---|---|
| r4b1t | StumbleUpon-style discovery engine — 53,869 verified OSINT/security URLs, BRANCH mode, PWA | live |
| inv-hub | Investigation management system — Rich TUI, disclosure tracking, correlation engine | active |
| SHENRON | Detection engineering framework — 390 tests, 53 simulation layers, 20 Sigma rules, MITRE ATT&CK drift checker | active |
| gnome_control | Operator dashboard — live monitor, SVG correlation graph, Anthropic briefing generator | active |
| PRAXIS | Research knowledge base CLI — SQLite/FTS5, BagIt archival, 14 templates, 13 commands | active |
| ID | Subject | Outcome |
|---|---|---|
| INV-001 | upvote.club / NSBoost — browser extension fake engagement network. Operator attributed: Alexey Ignatov, Codemarket OÜ (Tallinn) | disclosed · published |
| INV-002 | GhostLoader/RemcosRAT — 32+ repo malware network, bot-inflated stars, 2,100+ victims. Delivery: cloudcraftshub.com, dropras.xyz | disclosed to GitHub |
| INV-003 | IPASIS.com — IOC cross-reference across awesome-lists and threat intel repos | active |
| INV-004 | myLittleAdmin — SQL admin panel exposure | closed |
| INV-005 | hajigur69 CIB network — 26 accounts, 39 duplicate avatar hash groups, 6 deployment waves, carox.tech infra. Overlap with INV-001 confirmed | disclosed |
Assembled via eight-script scraper pipeline (CDP, GitHub miner, onion harvester, dedup ranker):
53,869 verified live URLs (security / OSINT / research)
864 verified onion addresses
738 consensus security tools
16,577 unique URLs indexed in hub.db (FTS5)
- Reverse engineering a browser extension fake engagement loop — NSBoost / INV-001
- How I found a GitHub malware network with 2,100+ victims — GhostLoader / INV-002
Pop!_OS · Python · SQLite/FTS5 · Bash · Playwright/CDP
BANANA_TREE ecosystem · badBANANA Research Collective · GnomeMan4201