← Defense board · written 2026-10-16 by claude-opus-5-5 from the pipeline's evidence only

Chadi (chadi0x): open-source OSINT tool with a paid investigations side business

What they built

Chadi (chadi0x) owns TheBigBrother, a Python OSINT platform [source]. Its listed features include username enumeration across 473+ platforms, crypto wallet analysis, EXIF extraction, dorking and network reconnaissance [source]. The README describes version 7.0 with "52 specialized intelligence engines" across 26 tabs [source].

The README also says a private version "relies on private breach databases, specialized servers, and proprietary premium APIs" [source]. It advertises a paid service at thebigbrother.cloud that produces "confidential PDF intelligence dossier" reports on a person, phone number, email, company or group [source].

A second repo, KillTheWatcher, is an anti-forensics toolkit with 22 stars [source].

Record

Measured signals (n=3, Skoor 45, confidence 0.7):
  • TheBigBrother: 771 stars, 117 forks, created 2025-12-08 [source].
  • About 75 stars per month since creation [source].
  • Account created 2025-01-29 [source]. This signal's source URL is not in the evidence.

    • Activity:

  • 11 commits to TheBigBrother in the last 90 days. The last push was 2026-10-13 [source].
  • 75 commits in the past year and 94 followers. Location is listed as Morocco. Company is not listed [source].
  • Papers: none in the evidence.

    • Why now

    The evidence gives no market or timing context. It shows only that the repo reached 771 stars within about ten months [source].

    Inference: the "defense" tag comes from the classifier. The product is consumer and commercial OSINT tooling, not defense hardware or a government program.

    Unknowns

  • Revenue, customers and portal volume: not in the evidence.
  • Team size: the README says "our team" [source]. Names and headcount are not in the evidence.
  • Founder's training, prior employment and full name: not in the evidence.
  • Legal basis for using breach data: not in the evidence.

    • Inference: the paid service sells dossiers on individuals built from breach data. This carries legal and reputational risk that may conflict with institutional LP requirements.

    Inference: the star count may reflect hobbyist interest in OSINT tools rather than buyer demand.

    Questions for the room

  • The README says the private version uses "private breach databases." Where does that data come from, and under which jurisdiction's law do you sell reports built on it?
  • The README refers to "our team." Who is on it, and how many paid dossiers has the portal delivered?
  • Of the 117 forks, how many come from SOC teams, red teams or government investigators, as opposed to individuals?

    • What would move the Skoor

  • Raise: documented paying institutional customers with a clear legal basis for the data used.
  • Lower: confirmation that the paid service depends on breached personal data or sells dossiers on private individuals without vetting buyers.