Phantom Agent / Capability-Led OSINT Triage
Paste a suspicious target. Get an evidence graph.
Runs approved public-source capabilities, labels evidence strength, and returns a reviewable graph for first-pass triage.
Checking account access.
Example target
suspicious-domain[.]com
Evidence path
Infrastructure lead
203.0.113.42
collect
Verified DNS record
A record: 203.0.113.42
verify
Review notes
Shared hosting needs review
Run anatomy
A target becomes a graph.
Phantom Agent keeps the run inspectable from first clue to reviewable SIERRA package.
Target
01
Normalize the clue
suspicious-domain[.]com
Capability
02
Select bounded checks
DNS, WHOIS, certificates
Evidence
03
Label what supports it
direct, observed, needs review
Review
04
Keep analyst control
notes and open questions
Handoff
05
Package for SIERRA
.SRAS graph handoff
Authorized work only. Analyst review required.
Run anatomy
A target becomes a graph.
Phantom Agent keeps the run inspectable from first clue to reviewable SIERRA package.
Agent run trace
Target to graph
Target
suspicious-domain[.]com
Domain clue, normalized for scoped public-source checks.
Capability trace
Evidence labels
Verified DNS record
A record: 203.0.113.42
direct
Certificate match
related hostname cluster
observed
Shared hosting
needs analyst review
question
Analyst review
Shared hosting needs review
Lead stays marked as a question until an analyst accepts the link.
SIERRA handoff
Target
graph node
Evidence
graph node
Review
graph node
Downloadable graph package
.SRAS
Authorized work only. Analyst review required.
Request preview access
Authorized phishing and infrastructure triage.
Phantom Helix
In silence, patterns emerge.
OSINT tools for modern investigators and security professionals.
© 2026 Phantom Helix Intelligence. All rights reserved.
Made with ❤️ for the OSINT community