I’ve been building Cylect, an AI-powered OSINT engine, and recently used it to deconstruct a live phishing campaign targeting Hotpads users.
What’s interesting here isn't just the phishing site itself, but the exfiltration path. Most of these scripts are "black boxes" to the average user, but by sending them a CanaryToken, was able to uncover their infrastructure behind it all:
The Collection: The victim enters credentials into a pixel-perfect Hotpads clone.
The Bundle: A script bundles the credit card information into a JSON payload.
The Transport: The script utilizes the Telegram API as a lightweight C2 (Command & Control) channel. It pings 149.154.161.248 (Telegram’s infrastructure).
The Attribution: The data was being routed to a receiver at 213.59.3.178, an IP located in Russia.
The Problem I'm Solving: Investigating this manually usually involves jumping between 20+ different browser tabs (VirusTotal, WHOIS, Hunter, URLScan, etc.). I built Cylect to unify 475+ OSINT tools into a single AI-powered workspace that can automate the "pivoting" between data points.
Additionally, doing this research in a completely separate VM Browser ensures that there is no attribution to you, while still having access to all 475+ OSINT tools, and Cylect AI, and an infinite Mind Map with notes.
The Business Model: I recently pivoted from a standard SaaS sub to a $5 Day Pass model. I found that OSINT researchers often have "bursty" workloads—they need deep access for 24 hours of intense investigation but don't want a recurring monthly bill.
I'd love to hear your thoughts on the investigation flow or the "Day Pass" model for developer tools!
For decades, high-level intelligence has been a one-way street. Entities like Palantir and three-letter agencies have spent billions building infrastructure to turn your digital footprint into a structured dossier in seconds. We believe that if billionaires and governments have the tools to look into your life, you should have the tools to look into theirs. We’re tired of the information asymmetry. That’s why we built ai.cylect.io, the first AI-native Virtual Machine designed for autonomous investigations. This isn't just a collection of scripts; it’s a secure, sandboxed environment where AI agents do the heavy lifting of cross-referencing breach data, satellite imagery, and social footprints. To prove that the "untrackable" are only untrackable because of a lack of access, we pointed our agents at PT. In minutes, our VM did what used to take a team of analysts weeks. It’s time to watch the watchmen.
If you don't want to pay, that's cool too. We have a free version, man (cylect.io).
I built this tool because I was tired of having to search the same term with 20 different tools during OSINT investigations. Cylect combines a directory of 475+ OSINT tools, a dedicated AI assistant, and a workspace for notes into a single pane of glass.
I recently realized that many investigators and CTF players don't need another monthly subscription—they just need a powerful tool for a specific investigation or weekend project.
So, I launched a $5 Day Pass (24-hour Pro access). No recurring billing, no lock-in.
The Stack:
Left Panel: AI OSINT Assistant (Built in AI Assistant with Cylect.io Awareness)
I’m not in your target user, but I love the “day pass, no recurring billing” concept and specifically applied the second half of that. (Without that, it’s shady.)
I can imagine many tools that I’d use under such a model, and while I suspect A/B testing would show it to be a loser, I’d be fine with that instead of a free trial for most things.
For a tool like yours that brings immediate value but maybe less on-going usage, it’s more prone to be good for both sides.
Exactly. I noticed that usage for the paid offerings tended to be sporadic for individuals. Research confirmed that Private Investigators and Law Enforcement operate on a case-by-case basis, so a monthly subscription model didn't align with their workflow. However, they still require capabilities beyond what the free tier (cylect.io) offers. For larger clients (like Security Operation Centers and MSSPs) that's where I see monthly working well.
Cylect.io's AI OSINT Tools is a powerful suite of open-source intelligence tools that leverages advanced technology to discover and analyze massive amounts of data, obtained by scanning public networks, from publicly available sources like social media, blogs, and forums.
Hey, it's the guy from the video. I worked with Tesla on this and we waited until a sufficient amount of vehicles had the patch before releasing it out. But if someone that acts maliciously, just releases it out without co-ordination with Tesla, that's a different ballgame. I would imagine they would roll it out ASAP.
What’s interesting here isn't just the phishing site itself, but the exfiltration path. Most of these scripts are "black boxes" to the average user, but by sending them a CanaryToken, was able to uncover their infrastructure behind it all:
The Collection: The victim enters credentials into a pixel-perfect Hotpads clone.
The Bundle: A script bundles the credit card information into a JSON payload.
The Transport: The script utilizes the Telegram API as a lightweight C2 (Command & Control) channel. It pings 149.154.161.248 (Telegram’s infrastructure).
The Attribution: The data was being routed to a receiver at 213.59.3.178, an IP located in Russia.
The Problem I'm Solving: Investigating this manually usually involves jumping between 20+ different browser tabs (VirusTotal, WHOIS, Hunter, URLScan, etc.). I built Cylect to unify 475+ OSINT tools into a single AI-powered workspace that can automate the "pivoting" between data points.
Additionally, doing this research in a completely separate VM Browser ensures that there is no attribution to you, while still having access to all 475+ OSINT tools, and Cylect AI, and an infinite Mind Map with notes.
The Business Model: I recently pivoted from a standard SaaS sub to a $5 Day Pass model. I found that OSINT researchers often have "bursty" workloads—they need deep access for 24 hours of intense investigation but don't want a recurring monthly bill.
I'd love to hear your thoughts on the investigation flow or the "Day Pass" model for developer tools!