ion

All web apps in the Catalogue

CRUCIBLE SIGINT

by neatlabs-ai · io.github.neatlabs-ai.crucible-sigint

Not TrustedWeb appUnrated★ 26 stars

Passive OSINT engine: one seed domain → full infrastructure cluster.

Passive OSINT engine: one seed domain → full infrastructure cluster. Automates Ryan McDonald's scam-kit fingerprinting methodology. crt.sh · urlscan · DNS · RDAP · JS wallet drain detection. Python/FastAPI · free · no API keys.

Screenshots

  • CRUCIBLE SIGINT on an Ion hub (desktop)
    CRUCIBLE SIGINT on an Ion hub (desktop)
  • CRUCIBLE SIGINT on an Ion hub (phone)
    CRUCIBLE SIGINT on an Ion hub (phone)

About

The foundational analytical approach in CRUCIBLE is directly inspired by the work of Ryan McDonald (Principal Security Engineer | USMC 0341). Ryan published ["Fingerprinting Malicious Infrastructure Using Free Resources"] (LinkedIn, May 2026), documenting his passive pivot of the DSJ Exchange / BG Wealth Sharing LTD pig-butchering operation — a $150M cryptocurrency fraud that victimized thousands of people, ultimately traced by FBI Operation Level Up with $41M in stolen funds frozen. Ryan demonstrated — using only free passive sources (crt.sh, urlscan.io, DNS, WHOIS, manual JS inspection) — how a single confirmed-bad domain maps an entire 47-domain criminal infrastructure cluster, identifies on-chain wallet drain mechanisms, and reveals the two-layer brand structure of a large-scale scam operation. CRUCIBLE SIGINT is the open-source project neatlabs-ai/crucible-sigint (https://github.com/neatlabs-ai/crucible-sigint) by neatlabs-ai, released under MIT. Ion packages it unmodified from commit 4322826f2622, adding only a manifest, an icon and a start script.

Source

Written by neatlabs-ai, published to Oikou by Ben Grande.

  • ★ 26 stars on GitHub
  • Licence: MIT
  • Built from commit 4322826f2622

View the repository on GitHub

Age rating

Not rated. Nobody has said who this app is suitable for, so Personal Clouds and the Oikou app treat it as 18+.

What version 0.20261002.0 may do

Internet

It asks to reach these hosts, and no others:

  • fonts.googleapis.com
  • fonts.gstatic.com
  • crt.sh
  • api.certspotter.com
  • dns.google
  • freeipapi.com
  • ip-api.com
  • rdap.org
  • urlscan.io

Personal Cloud tools

None. It uses nothing from your Personal Cloud beyond its own storage.

Notifications

It does not send push notifications.

Storage

Up to 512 MB on your Personal Cloud.

Its address

Works best with its own address. A Personal Cloud shared through Cloudflare can give it one; on a private Personal Cloud on Tailscale it opens under your Personal Cloud’s address, where it may not work fully. Private and shared Personal Clouds

Add to Personal Cloud

Sign in to add this web app to a Personal Cloud of yours. It runs there, on your own computer, and you open it from there; nothing is installed on your phone.

Sign in to add

Versions

0.20261002.0 Latest Shown above

Published · a ready-built bundle

Imported from neatlabs-ai/crucible-sigint at 4322826f2622.

Report this app