FBI Watchdog : A Comprehensive OSINT Tool For Cyber Threat Intelligence

FBI Watchdog is an advanced Open Source Intelligence (OSINT) tool designed to monitor domain DNS changes in real-time, with a particular focus on detecting law enforcement domain seizures.

It provides critical cyber threat intelligence updates, making it a valuable asset for cybersecurity professionals and researchers.

Core Functions And Features

1. Real-Time DNS Monitoring
   FBI Watchdog tracks changes in DNS records such as A, AAAA, CNAME, MX, NS, SOA, and TXT. This ensures prompt detection of any alterations that may indicate malicious activity or law enforcement intervention.
2. Seizure Detection
   The tool identifies domain takeovers by law enforcement agencies by monitoring DNS servers like ns1.fbi.seized.gov and ns2.fbi.seized.gov. It also supports .onion domains for tracking hidden services.
3. Notifications and Alerts
   Users are notified of DNS changes or seizures via Telegram and Discord. Alerts include detailed information and screenshots of the affected domains, captured using Selenium.
4. Data Storage and Updates
   FBI Watchdog maintains a history of DNS states in JSON format and checks for updates at startup to ensure users operate with the latest version.
5. Cross-Platform Compatibility
   The tool runs seamlessly on Windows, Linux, and macOS, making it accessible to a wide range of users.
6. Rich CLI Output
   Utilizing the rich library, the tool provides colored logs for better visibility during operation.

• SSL errors may occur during screenshot capture due to mismatched SSL versions.
• Occasional duplication of Telegram alerts.
• DNS query failures for certain domains due to NXDOMAIN errors.

Planned features include support for Slack and email notifications, database integration (SQLite/PostgreSQL), detection of seizures without DNS changes, and faster scans using asynchronous processing.

To set up FBI Watchdog:

1. Clone the repository from GitHub.
2. Install dependencies using pip install -r requirements.txt.
3. Configure environment variables (Discord webhook, Telegram API key).
4. Add domains to monitor and run the script with python fbi_watchdog.py.

FBI Watchdog is a powerful tool for monitoring domain activity and detecting cyber threats. Its real-time capabilities and cross-platform support make it indispensable for cybersecurity efforts in an increasingly digital world.