TheBigBrother: a multi engine OSINT console in Python

A console of 52 engines, not a script

The Big Brother V7.0, branded NEXUS, is a cyber-operations OSINT and threat intelligence platform written in Python and served as a web application. The project describes it as state of the art, engineered for red teams, SOC analysts, geolocation experts, and defence investigators.

The scope is large and stated in the repository description: username enumeration across 473 or more platforms, quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.

What makes it a platform rather than a tool is the interface. The README advertises 52 dual-engine tactical modules across 26 tabs in a console with a glassmorphism interface, and the central design decision is the dual-engine switcher. Every tab in the workspace features two full-power operational tools, a primary reconnaissance tool and a companion power engine, and you alternate between them through a zero-reload switcher bar with no page reloads in between.

That structure is the reason to look at the project even if you only use a handful of the modules, because the alternative is thirty separate tools with thirty different output formats. Here every tab produces output in the same console, and the Nexus Graph Canvas can consume the results of any tab that has relationships in it.

The project is MIT licensed, the version is 7.0.0, the default branch is main, and the last push was on 2026-10-13. The Python package metadata puts the development status at Beta, requires Python 3.9 or newer, and exposes a console script called the-big-brother that points at the main module.

What the first ten tabs actually do

The matrix in the README is the most informative table in the project, and reading it tells you what kind of tool this is.

The Command Center pairs with an Incident Tracker and DEFCON panel, giving a global threat ticker, the live DEFCON posture, the CISA KEV catalogue of known exploited zero-days, undersea cable fibre breaks, and hyperscaler latency. The AI Analyst tab sits next to a Playbook Simulator that does Diamond Model mapping, MITRE ATT&CK kill-chain emulation, and automated Sigma and YARA-L rule generation.

Chain Tracer covers multi-chain wallet tracking for BTC, ETH, and TRX, with OFAC sanctions screening, and its companion is a Honeypot Auditor that looks for token contract drainers and honeypots and audits buy and sell taxes. Pixel Forge does media ELA and clone detection across nine engines, with a Stego Hunter and Carver companion for LSB steganography and for extracting embedded PKZip, ELF, and PE payloads from images.

The credential-adjacent pair is Hudson Rock Cavalier with a Stealer Log Parser. The first searches for compromise through the Hudson Rock Cavalier API, and the second does deep parsing of raw RedLine, Vidar, Raccoon, and Lumma infostealer archives.

Then there is the identity cluster. Shadow Clone runs more than forty username mutation and typosquatting scans across more than eighty platforms, with a Stylometry Profiler companion doing forensic linguistic comparison, punctuation and vocabulary fingerprinting. Spider Crawl does recursive web crawling with a Param Miner and OpenAPI companion that looks for more than twenty-five API secret key patterns, discovers Swagger and OpenAPI manifests, and can inject debug parameters and fuzz for reflection.

Doc Autopsy reads Office and PDF revision histories and metadata, with a Document Detonator companion that hunts for shellcode NOP sleds, malicious VBA macros, and risky PDF streams. Voice Print analyses AI voice deepfake vocoders, with an ENF Acoustic Profiler that extracts the 50 hertz or 60 hertz electrical network frequency hum to estimate room size. Orbital Eye pairs with a Star Solver and Astro-Geo module.

Two of these deserve a pause. The infostealer log parsing and the API secret scanning are the features a defender wants, because the archives contain what was stolen from other machines and the regexes find what your own applications leak. The username and typosquatting scans are the features a person running recon on a colleague would use. The same code, different intent, and the difference is entirely in the authorisation.

Pure standard library modules, and the graph canvas

Two implementation details stand out in the what is new section, and both are about not depending on anything.

The first is the pure-Python forensics. All 22 new companion power modules operate with zero third-party dependencies, using pure-Python standard libraries, and the README names them: urllib, ssl, math, struct, wave, socket, and hashlib. The stated reason is for fast, crash-proof execution in any container or bare-metal environment.

That is a sensible engineering decision for a container-shipped tool, and it is worth knowing what it means. A module that parses a steganographic payload or extracts a certificate with nothing but the standard library cannot break because a dependency moved, and it can run in a minimal image where installing a wheel is the hard part. The wave module in that list is the giveaway that audio analysis is among the companions.

The second is the Nexus Graph Canvas, which the README says has been completely overhauled with zero mock data. It is restricted strictly to relationship-capable tabs, and it generates its topological nodes and edges directly from live scan payloads, with Force-Directed using the COSE layout, Concentric, and Circle layouts available.

The no mock data detail matters more than it sounds. A graph visualisation seeded with sample data is decoration, and a reviewer who discovers that the demo graph was hardcoded learns to distrust every panel. A canvas that only works on the tabs that return relationships, and that draws only what the scans actually returned, is a tool rather than a mock-up, and it is the natural place to spot a false positive, since a cluster of nodes that the data does not support is visible at a glance.

The code hunter, and what it does with public git data

The fourth item in the what is new section is a fix list for the code hunter, and it is the most instructive part of the README because it describes exactly what a public source code search can be made to yield.

The fixes cover the extraction of followers, following, company or organisation, and public gists. Then there are two additions. The tool cross-references public PushEvent payloads and commit histories to extract unmasked author and committer emails, and it extracts SSH public keys, GPG signing keys, and programming language distributions.

All of that comes from data that is public by construction. A PushEvent is an event in a public repository's event stream, and a commit history is in the repository itself. The unmasked part is the point: a commit is often signed, and the signature shows a name and an email that differ from the account that pushed it, and that difference is a link between two identities.

The SSH and GPG keys are public keys, and the language distribution is a derived statistic about a person's work, which is why the README describes it as telemetry.

The judgement to make here is not about the technique, which is a well known category of public source mining, but about the aggregation. Individually, a language distribution is harmless. Cross-referenced across platforms, unmasked emails, and commit histories, the same set of queries becomes a linkage between pseudonymous accounts and a real person, and the platform's own design, with the graph canvas and the digital footprint reconstruction in the description, is built for that aggregation.

The stack, the container, and the local deployment

The application is a Python package with a FastAPI backend, and the container setup is the fastest way to run it.

The dependencies are the usual OSINT toolkit. FastAPI and uvicorn for the server, requests and requests-futures for HTTP, beautifulsoup4 for parsing, playwright for the browser automation, duckduckgo-search for the search side, pandas and openpyxl for the data work and the exports, colorama for terminal output, and tomli for Python versions before 3.11. The requirements file adds the more specialised ones: holehe, phonenumbers, dnspython, pyvis and networkx for the graph work, Pillow for the image analysis, python-whois, python-multipart, aiohttp, and psutil. The Playwright version is pinned to 1.49.0 in the requirements file, which matters because the browser and the driver have to agree.

The Dockerfile starts from the official Playwright Python image at version 1.49.0 on Jammy, installs the requirements, and then force-installs Chromium with a comment explaining why: to guarantee that the chromium_headless_shell binary path matches whatever the pip-installed Playwright resolves to, even if the base image bundles a browser from a different release. That is a real problem being solved rather than a redundant line, since a mismatched browser is the classic Playwright failure in Docker. The container exposes port 8000 and starts uvicorn on the GUI module.

The compose file adds Redis, which the environment variables point at, and it names the intent: NEXUS_ENV is set to production there while the dev compose would not. The service mounts the working directory into the container, so the code you edit is the code that runs, and both services are set to restart unless stopped.

The package itself exposes the console script the-big-brother, and the package data includes py.typed along with the gui and resources directories, so the type information and the front end assets ship with the install.

The paid portal behind the open source release

The first block of the README is an announcement, and it is the part any careful evaluation has to weigh.

The author states that there is an exclusive private version of the engine that is significantly more powerful than the open-source release, and that because it relies on private breach databases, specialised servers, and proprietary premium APIs, it cannot be open-sourced directly. He then points at a live surveillance portal for anyone who needs deep investigative intelligence on a person, a company, or a group, describing a deep-vector reconnaissance scan on a name, a phone number, an email, a company, or a target group, delivered as a full, confidential PDF intelligence dossier report at a price.

So the open-source project is the visible half of a commercial operation whose more capable half depends on data that cannot be shipped, and that data is breach data. That has three consequences for anyone evaluating it.

The first is legal exposure. Breach data in a commercial reconnaissance service is the kind of thing that attracts attention from the people who own the data and from the authorities, and the users of such a service inherit some of that risk even if the service operator carries it.

The second is that the open-source release is a marketing funnel with a real function. It demonstrates the interface, it gives away the parts that are buildable from public data, and it identifies the users who need the parts that are not. That is a legitimate business model, and it is also the reason to read the feature list with the announcement in mind.

The third is about scope. The README itself frames the platform for red teams, SOC analysts, geolocation experts, and defence investigators, and the code of conduct, the security policy, and the pull request template in the repository are the visible governance. Whether those match the intentions of a person who buys a dossier on a named individual is a question the project does not answer, and the README is candid about where the boundary of the open source part is.

For an engineer, the practical conclusion is that the open-source release is usable and worth reading, and that the commercial tier is a separate decision with its own legal analysis, which is not something the code can settle.

Editorial conclusion

TheBigBrother fits a red team or SOC analyst who wants a single console covering username enumeration, document metadata, steganography, exposed secret discovery, and threat feeds, and who has the legal basis to collect that data. It does not fit anyone who intends to run it against a person or an organisation without authorisation, since the open source release already profiles targets and the paid portal behind it does it as a service. Verify first that you are permitted to investigate the targets, that you read the SECURITY.md and the code of conduct, and that the data you export stays inside the scope of that permission, because the platform's own design is aimed at building a profile of a person from many small pieces.

Frequently asked questions

Official sources

1. chadi0x/TheBigBrother on GitHub
2. Issues
3. License: MIT
4. Project website
5. README