Osintgram is a locally-run Python OSINT tool that aggregates and cross-references publicly available Instagram profile data for investigators and authorized security professionals.

Osintgram is a well-established open-source intelligence project by Giuseppe Criscione (Datalux), currently at version 2.0 and licensed under GPL-3.0, with over fourteen thousand stars on GitHub. The original release was a command-line shell for interrogating Instagram accounts; version 2.0 rebuilds the tool around a web interface served locally via uvicorn, adds an AI-assisted mode backed by a local Ollama model, and introduces cost controls for the paid data backends it relies on. The stated goal is blunt: point it at an Instagram account and lay out everything that profile publicly gives away, cross-referenced and visualized rather than dumped as raw JSON.

Architecturally, the tool is a consumer, not a scraper of its own — Instagram data comes from one of two backends: HikerAPI, a commercial API service, or instagrapi, an open-source Instagram private-API wrapper that authenticates with an Instagram account you supply. This separation matters for operators: the tool itself never talks to Instagram directly, so the reliability, rate characteristics, and account risk of a run depend entirely on which backend you configure. The README is refreshingly honest about the trade-offs and directs users to a separate guide covering both setups.

The interface offers two operational modes. In base mode, all 28 commands are presented as a grouped, searchable picker; the analyst ticks what they want, sets parameters, and runs lookups in order. In AI mode, a local model — the default suggestion is llama3.1:8b pulled through Ollama, roughly 4.7 GB — interprets natural-language questions like "which hashtags do they use most," selects the relevant commands, executes them, and summarizes results. Importantly, the model is constrained to the fixed command list: it cannot invent lookups or fabricate data, and every AI answer is accompanied by the raw results underneath so the analyst can verify rather than trust the prose.

What the 28 commands surface is grouped into four rough categories. Profile lookups pull bio links, follower/following/post counts, public email, phone, business address with coordinates, linked Facebook ID, and Instagram's own "About this account" metadata — country of registration, creation date, and username-change history. Network analysis enumerates followers and followings, suggested-related accounts, tag relationships, top commenters, and mutual connections between two accounts. Content analysis ranks hashtags by frequency, aggregates captions and comments with like/comment statistics, breaks down photo/video/carousel composition with view counts and paid partnerships, and produces a weekday-by-hour posting heatmap. Contact harvesting scans a target's follower or following lists for exposed email addresses and phone numbers.

Two features stand out for tradecraft value. The posting-times heatmap is a classic behavioral fingerprint: when an account is active across the week often reveals timezone and routine faster than any content clue. And the geotag map, rendered with Leaflet and geocoded via Nominatim/OpenStreetMap, plots location-tagged posts — the kind of aggregate that turns individually innocuous check-ins into a movement pattern. Both are passive correlations of data the target chose to publish, which is precisely the OSINT sweet spot: no exploitation, no authentication bypass, just aggregation of public exhaust.

The command surface also extends beyond a single target: hashtag and place lookups require no account at all, returning posts published under a hashtag or from a location along with their publishers. Media access — stories, highlights, profile pictures — resolves to direct CDN links, and any result card with media offers a one-click zip of the originals. For investigative workflow integration, a finished search exports as a standalone HTML report that opens in any browser with no server dependency, which is a genuinely useful feature for handing findings to a client or case file without shipping the whole toolchain.

The cost-control layer is the most unusual engineering decision in version 2.0. Because HikerAPI charges per lookup, the interface prices a selected command batch before execution, displays remaining credit, caches every response so the same lookup is never billed twice, and allows a run to be capped or stopped server-side rather than merely closing the browser tab. For anyone who has burned through an API quota mid-investigation, this is a meaningful operational safeguard, and it signals a tool written by someone who has actually used it in anger.

Privacy posture is local-first, and the README is explicit about it: the interface binds to 127.0.0.1, the AI model runs entirely on the host with no OpenAI key or external prompt transmission, and in the Docker deployment the API key, cache, and saved dossiers persist on the host in config/, cache/, and dossier/ rather than inside the image. The warning section is equally blunt — the server has no authentication, so exposing it past localhost without an auth proxy is on the operator. Credentials live in config/credentials.ini, which is git-ignored; the README correctly notes that a pushed key must be rotated since deletion doesn't scrub history.

The project's governance hygiene is above average for this category. A pytest test suite runs entirely against synthetic fixtures — no API key, no network, no quota — and also verifies that documentation hasn't drifted from code, which is a small but telling quality signal. There's a SECURITY.md channel for private vulnerability reports, an active contributor base, and CI badges indicating tests run on every push. The disclaimer section covers responsible use: educational purpose only, don't use your primary Instagram account with instagrapi, handle results in line with GDPR and Instagram's Terms of Use, and — correctly — a note that private profiles cannot be viewed and tools claiming otherwise are scams.

From a defensive perspective, Osintgram is best understood as a demonstration of how much inference is possible from public metadata alone. For red-teamers it maps the reconnaissance an adversary performs on an organization's social presence; for blue teams it quantifies what employee accounts leak through geotags, contact exposure in follower lists, and posting-time patterns. Security awareness programs benefit from concrete examples, and this tool produces them. Defenders should note that all its queries flow through HikerAPI or instagrapi infrastructure — meaning detection opportunity lies at the platform-abuse layer, not at the analyst's endpoint.

Running it is straightforward: pip install -r requirements.txt then uvicorn src.web.app:app --host 127.0.0.1 --port 8000, or docker compose up --build for the containerized path. Osintgram occupies a legitimate niche — passive, public-data OSINT with good operational hygiene — and its version 2.0 rewrite reflects mature engineering choices: constrained AI assistance, transparent cost accounting, and a default posture that keeps everything on the operator's machine.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.