Osintgraph scrapes public Instagram profiles, followers, posts and comments into a Neo4j graph and adds a Gemini-powered agent for natural-language investigation of the resulting network, intended for authorized OSINT work.
| Tool | XD-MHLOO/Osintgraph — Instagram OSINT collector that maps social networks into Neo4j with an AI agent front-end |
| Category | OSINT / social-media intelligence and graph analysis (Python, GPL-3.0) |
| Primary Use | Collecting public Instagram data (profiles, followers, followees, posts, comments, likes) and investigating relationships via Neo4j visualization and natural-language queries |
| Safe Use | Authorized investigations, sanctioned due-diligence and law-enforcement/CTI work, and research in lab environments using consenting accounts; scraping must respect platform terms and applicable law |
| Telemetry Note | All activity originates from the Instagram account whose cookies the operator configures in osintgraph setup; the README warns account suspension is a risk and offers a custom user-agent option — from the platform side, this looks like high-volume scraping from one session, easily flagged by rate and behavior analytics |
Osintgraph positions itself as a deep social-analysis instrument for OSINT investigations focused on Instagram, and its architecture is the interesting part. Rather than dumping scraped JSON into flat files, it normalizes everything into a property graph in Neo4j, turning a sprawling social footprint into something an investigator can actually traverse. With 953 stars on GitHub, written in Python and licensed under GPL-3.0, it is a serious community project, not a weekend scraper. This writeup is a documentary analysis for authorized professionals evaluating collection and analysis tooling.
The tool works in two explicit phases. Phase 1, reconnaissance, is executed with osintgraph discover <target> and scrapes the target's public profile metadata, followers, followees, and posts with their comments. Phase 2, analysis and investigation, is where the collected graph is queried — either through the interactive AI agent launched via osintgraph agent, or directly through the Neo4j console browser. That separation of collection from analysis is a sensible design that mirrors classic intelligence cycles: gather raw data first, exploit it later.
There is also a recursive collection mode: osintgraph explore <target> re-runs discover against each of the target's followees, prioritizing those with the largest follower bases already present in the Neo4j database. This is the feature that turns a single-account scrape into genuine network enumeration, and it is also the feature that demands restraint — recursive crawling across a target's entire followee graph can generate enormous request volume against Instagram, which is why the README dedicates a whole section to avoiding account suspension.
The data model is worth reading closely because it reveals how the tool thinks. The Neo4j schema defines a Person node for each Instagram account, a Post node, a Comment node, and relationship edges covering likes, follows, and replies. Because interactions are first-class graph edges, questions like mutual-follower analysis or which accounts most frequently comment on a target's posts become simple traversals rather than manual correlation. The README's own worked example — tracing a target's close connection through their most-commented post, then investigating mutual followers and all interactions between the two — shows the intended investigative workflow.
The AI layer is where Osintgraph differentiates itself from older Instagram scrapers. If a Gemini API key is configured during osintgraph setup, the tool runs a pre-analysis pipeline over collected data: image analysis on post media generating structured reports, post analysis combining image findings with metadata and comments, and finally an account-level analysis summarizing patterns across all posts. The agent then supports four query modes documented in the README — basic data retrieval, relationship traversal, content search including keyword and semantic search, and template-driven analyses that can consume the pre-analyzed data immediately.
The template system is a practical touch for repeatable work. Predefined analysis templates can be run against collected data, and the README documents how to author custom templates, which matters for teams that need consistent, reportable methodology across investigations rather than ad-hoc prompting. Combined with the agent's documented best-practices guidance on how to phrase questions, the project is clearly aimed at investigators who want structured output, not just a chat toy.
Operationally, the setup burden is moderate and the README is honest about it. You need an Instagram account — explicitly recommended to not be your main one, a sensible opsec note — plus a Neo4j instance with admin credentials, a Gemini API key, and optionally a custom user-agent string harvested from a logged-in Firefox session to reduce detection risk. The osintgraph setup command handles configuration per service (instagram, neo4j, gemini, user-agent), and osintgraph reset reconfigures any of them when credentials expire. Installation itself is a one-liner: pipx install osintgraph.
Collection commands expose rate-limiting controls — the README's example is osintgraph discover TARGET_INSTAGRAM_USERNAME --limit follower=100 followee=100 post=2, bounding how much data each run pulls. Runs are also resumable: if a target has thousands of followers and a run cannot finish, progress is saved automatically. For long-tail investigations this is essential engineering, because Instagram scraping is inherently interruption-prone and losing hours of collection state would make the tool unusable against large accounts.
From a defensive perspective, the telemetry footprint is concentrated and observable. Every request comes from the session cookies of the single Instagram account configured in setup, so platform-side anomaly detection sees one identity performing follower, followee, post, and comment enumeration at unnatural velocity — precisely the behavioral pattern anti-abuse systems are built to catch. Defenders modeling insider misuse of corporate social accounts should note the README's suspension-avoidance section as a roadmap of what careless operation looks like. There is also third-party exposure worth auditing: collected data and analysis results flow to Neo4j (potentially a cloud instance) and to Google's Gemini API, which is a data-handling consideration any professional investigation program must assess before use.
The GPL-3.0 license and Python implementation make the tool auditable end to end — no compiled binary, no opaque collection logic — which is exactly what you want before pointing any scraper at real accounts. The README is unusually thorough for this genre, documenting commands, the graph schema, agent usage patterns, and template authoring, suggesting an actively maintained project intent on being usable by people other than its author.
Where Osintgraph fits in an authorized workflow is clear: it is a collection-and-analysis backbone for investigators with a legitimate mandate — due diligence, threat-actor attribution research on public adversary infrastructure, or sanctioned law-enforcement inquiry — who need Instagram relationships expressed as a queryable graph rather than screenshots. It is not, and should not be treated as, a tool for casual snooping on private individuals; the same recursive enumeration that makes it powerful makes it intrusive when pointed at people without authorization, and platform terms plus privacy law apply fully to everything it collects.
In sum, Osintgraph is one of the more thoughtfully architected entries in the Instagram OSINT niche: two-phase design, resumable collection, a proper graph schema, and an AI agent layered on top of structured pre-analysis. For authorized professionals, the main diligence items are the third-party data flows to Neo4j and Gemini, account-suspension risk for the operator's collection identity, and strict scoping of explore runs. Handled with that discipline, it is a capable instrument for turning public social data into graph-native intelligence.
XD-MHLOO/Osintgraph.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.