Gökbörü Intelligence: phone and username investigation with a web GUI and CLI

Phone and username OSINT from a browser or a terminal

Gökbörü Intelligence is a Python tool that looks up phone numbers and usernames against multiple external data sources. Two interfaces are offered: a web GUI that opens in a browser and a CLI console that runs in the terminal. Both expose the same two modules, a phone module and a username module, and the README shows the same source-selection and query steps in both paths, so the choice between them is a matter of preference rather than capability.

Every scan requires passing through an "authorized query" confirmation step, which appears in both interfaces before data retrieval begins. Nothing in the README explains how that confirmation is enforced or verified technically, so it functions as a procedural reminder rather than an access control mechanism. Running a query without acknowledging it is not addressed in the documentation.

Gökbörü Intelligence connects to commercial lookup services such as Truecaller and Sync.me for phone data, and accepts Telegram API configuration for messaging-platform queries. Quality and completeness of any result depends on what those third-party services return for the target identifier. Published under the MIT licence, its pyproject.toml names the Python package as "moriarty-v5" at version 0.1.0, a designation that points to a significant revision from the 2022 V4 tagged releases.

Ubuntu-only installation wizard and Python 3.11 as the required floor

A single installation path is documented: download and extract the project, open a terminal in the project folder on Ubuntu, and run the install script.

bash ./install.sh

This launches a four-step GUI wizard. Step one shows a welcome screen with a Continue button. At step two, configuring Truecaller and Sync.me requires a Microsoft account, while accessing Telegram features requires API details entered at the same screen; any service skipped here becomes inactive for the rest of the session. At step three, API keys for further services can be added, with optional fields that can be left blank. Step four shows a review screen before the installation proceeds.

Minimum Python version is 3.11, as declared in pyproject.toml under `requires-python = ">=3.11"`. Python installations older than 3.11 will not satisfy the requirement. Eight runtime packages are listed: phonenumbers (>=8.13,<10), pypdf (>=5,<7), dnspython (>=2.6,<3), Pillow (>=10,<13), zxing-cpp (>=2.2,<3), playwright (>=1.49,<2), telethon (>=1.36,<2), and textual (>=0.89,<2). Ubuntu is the only named platform; no instructions appear for macOS, Windows or containers.

Starting the web workspace at http://127.0.0.1:8765/

After installation, the web interface starts with one command:

bash ./moriarty-local web-workspace

According to the README, the page opens automatically; the README gives http://127.0.0.1:8765/ as the fallback address for browsers where it does not open on its own. Once loaded, a query form asks for the target type (Phone or Username), the target value, the set of sources to query, and an explicit authorization confirmation before the Investigate button becomes actionable.

Each result in the output list can be clicked to expand its details. A separate Case Review view groups findings by category rather than listing them individually. How many sources appear in the selection list is not documented, nor is whether that list adapts to reflect only the services configured during setup. Query duration is also not addressed.

Port 8765 is hardcoded in the README's example address. No configuration option for changing that port appears in the documentation, and no environment variable for it is mentioned among the top-level repository files.

CLI module selection, target entry, and the authorized confirmation step

Opening the CLI interface uses a different argument than the web workspace:

bash ./moriarty-local

Typing `help` at the prompt shows available commands. A complete username search session is given in the README:

use username
target YOUR_USERNAME
sources quick
authorized yes
run

For a phone query, replace `use username` with `use phone` and supply a phone number as the target value. `sources quick` selects a preset group of sources, but the README does not document other valid source arguments, or which sources belong to the "quick" preset.

After a scan completes, three display commands become available: `show results`, `show profiles`, and `show breaches`. A CLI-USAGE.md file is listed among the top-level repository entries but is not reproduced in the README, so a full command reference requires reading that file directly after installation.

Entering `authorized yes` is the CLI equivalent of the web GUI's authorization checkbox. It appears as a required step in the example session, but the README does not describe what happens if it is set to `no` or left out entirely.

Service credentials gate Truecaller, Sync.me and Telegram queries

Setup wizard output determines which sources are active throughout a session. Truecaller and Sync.me require a Microsoft account entered at the identity step, while Telegram queries require API details at the same wizard screen. A third wizard screen asks for API keys for additional services but does not name those services or say how many are supported.

Running the tool with no credentials will disable some sources, but the README does not say how many sources are available in total, which are credential-free, or whether the web GUI's source selection list changes to show only the services that were configured. This is the main operational gap a new user encounters before the first real query: the configured state is not visible anywhere in the documentation.

Telethon (>=1.36,<2) is listed as a runtime dependency, confirming that the Telegram integration depends on a dedicated client library. No documentation describes the Telegram authentication flow beyond the wizard step that asks for API details. Whether the tool stores session tokens on disk between runs, and where it writes them, is not addressed in the README.

Results, profiles, and breach exposure as three separate view commands

After a scan, three view commands are available from both interfaces. `show results` returns raw findings from the queried sources. `show profiles` groups social or messaging accounts found for the target. `show breaches` shows appearances in data breach records, and the Case Review panel in the web GUI presents these same three categories.

Which breach databases are queried is not named anywhere in the README, and how a phone number is matched against breach records is not explained. Breach datasets vary in how they index personal identifiers, so the coverage of a phone query against breach data is unknowable without direct testing against a number that is known to appear in breach records.

Result storage is unaddressed throughout the documentation. Whether findings are written to disk after a session ends, or held only in memory during the run, is not stated. Closing the web workspace or the CLI session without copying output manually would lose any findings if the tool does not persist them, and the README does not clarify this behavior.

MIT licence, two 2022 tagged releases, and a 2026-09-09 last push

Two tagged releases from 2022 appear in the release history: MoriartyProject-V4.1.2 on 2022-09-21 and MoriartyProject-V4.1.1 on 2022-08-25. Current pyproject.toml names the package "moriarty-v5" at version 0.1.0, pointing to a significant revision after the 2022 V4 series. What changed between V4 and V5 is not documented in the README, and no changelog or release notes for the 0.1.0 codebase appear in the top-level repository listing provided.

Last push to the repository was on 2026-09-09, and the repository is not archived.

MIT licence applies to the project. One entry point is defined in pyproject.toml: `moriarty = "moriarty.cli:main"`. Installing the package via pip would place a `moriarty` binary on the path, though the README's install path uses `install.sh` rather than a direct pip install step. A dev dependency, pytest (>=8,<9), is the only testing-related entry in the project configuration, and no test directory is mentioned in the README.

Editorial conclusion

Gökbörü Intelligence is worth setting up if you need a single interface that combines phone number lookup and username investigation across multiple data sources, and you already hold API keys for Truecaller, Sync.me or Telegram. Skip it if your environment is not Ubuntu, if you need documented build steps from source, or if you have no third-party credentials, since most queries require keys supplied at setup. Before you run it against a real target, read the setup wizard output to confirm which services were configured and which were silently skipped.

Frequently asked questions

Official sources

1. AzizKpln/Gokboru_Intel on GitHub
2. Issues
3. License: MIT
4. README
5. Releases