$ overview_
> welcome.txt
MABU is a personal, locally-hosted OSINT research platform for organizing publicly available digital footprint data. Email checks, Discord snowflake analysis, username enumeration, network/IP tooling, hash & encoding utilities, case timelines, and encrypted vault storage — all running on your own machine.
[!] NOTICE: All data stays on 127.0.0.1. Nothing is transmitted externally. Only document information you have lawful, legitimate access to.
> vault --stats
> quick_actions
> module_manifest.log
- [research] structured OSINT documentation form → encrypted .mabu vault entry
- [vault] browse / search all encrypted case files
- [reader] decrypt & render .mabu files, export JSON
- [timeline] chronological case view + shared-identifier relationship graph
- [email] format validation, domain classification, manual platform tracker
- [username] cross-platform handle tracker, permutation generator, direct-check links
- [discord] snowflake → timestamp decoder, account-age calc, bit-layout reference
- [network/ip] IPv4/IPv6 classification, CIDR calculator, port reference table
- [hash & encode] MD5/SHA1/SHA256, Base64, URL encode, JWT decoder
> email --analyze
> platform_tracker.db
Log platforms manually confirmed via the platform's own signup/reset check. No automated third-party querying.
| platform | status |
|---|
> username --target
Generates direct search-URLs per platform (opens manually, no auto-querying) and tracks confirmed/unconfirmed status locally.
| platform | link | status |
|---|
> permutation_engine
Generates common username variants for a first/last name or base handle — useful for building a search list.
> observed_handles.log
Manually-confirmed usernames/handles tied to this investigation, with source.
| username | source |
|---|
> snowflake --decode
> snowflake_structure.h
64-bit integer encoding a timestamp + internal identifiers, relative to Discord Epoch (2015-01-01T00:00:00.000Z).
Bit layout (64 bits total): 63 22 21 17 16 12 11 0 | timestamp (42 bits, ms since epoch) | worker | process | increment | DISCORD_EPOCH = 1420070400000 // unix ms timestamp = (snowflake >> 22) + DISCORD_EPOCH worker_id = (snowflake & 0x3E0000) >> 17 process_id = (snowflake & 0x1F000) >> 12 increment = snowflake & 0xFFF
> ip --classify
> cidr --calc
> ports.ref
Common port reference table (educational).
| port | protocol | service |
|---|
> hash --generate
> base64 / url --codec
> jwt --decode
header
payload
> case --new
Document only publicly available information you have lawful access to. Creates a new case (with this as its first entry) in the local vault. Add more entries to the same case later from the Vault tab.
> vault --list
| title | status | entries | updated | investigator | tags |
|---|
> case_detail:
add new entry
> correlate --scan
Scans every decryptable case in the vault and auto-links cases sharing an email, username, IP, phone, or name. Clusters below represent likely-same-person groups.
> correlation_graph.svg
> whois --lookup
> dns --lookup
> handle --check-live
Sends a real HTTP request to each platform's own profile URL (same as visiting it in a browser) to check whether the page exists. No third-party aggregators are queried.
| platform | url | likely exists | detail |
|---|
> phone --lookup
Local parsing via libphonenumber — no external API. Region/carrier data comes from bundled offline databases.
> breach --check
checking configuration...
> image --metadata
Extracts EXIF data (camera info, timestamps, embedded GPS coordinates) from an image file, entirely locally — nothing is uploaded anywhere else.
> reader --decrypt
> stdout
nothing decrypted yet.
> timeline --render
Chronological view of all vault entries (decryptable with the default key). Passphrase-protected files appear locked and are excluded from the relationship graph.
> relationship_graph.svg
Cases are linked when they share an email, username, IP, or name. Hover a node for details.
> users --list
| username | role | active | created |
|---|
> audit_log.jsonl
| time | actor | action | detail |
|---|