ALIBI 1.0: Planetary Tech & Defense Terminal

ALIBI is the open-source planetary intelligence terminal for engineers — a free, real-data alternative to Palantir's God's Eye view and Bloomberg's $30,000/year corporate terminal.

• 100% Real 2026 Data. Zero synthetic records. Zero honeypot approximations. Zero outdated static datasets.
• Free Forever. Open-source MIT license.
• Built for Engineers & Leaders: Ethical hackers, DevOps/cloud architects, ML engineers, and technical leadership.

A full-screen 3D WebGL Earth (NASA Blue Marble) mapping all 4,596 world states and provinces:

• Active Malware C2 & Botnets: Live botnet controllers and malware distribution points (abuse.ch Feodo, ThreatFox, URLhaus) mapped via DB-IP.
• Censorship & Internet Interference: Confirmed web blocks and tampering telemetry from OONI Explorer.
• Submarine Cable Infrastructure: 733 global undersea fiber-optic cable routes and landing stations (TeleGeography).
• State Cyber Threat Density Score: Hostile nodes per million IP addresses.

Search any company, domain, or technology (Cloudflare, CrowdStrike, Stripe, your-org.com):

• Corporate Cloud Footprint: BGP ASNs, upstream ISPs, and network ranges.
• Attack Surface Discovery: Real-time Certificate Transparency log enumeration (crt.sh) for subdomains.
• Exploited Flaws & Weaponization: CISA Known Exploited Vulnerabilities (KEV) cross-referenced with FIRST EPSS exploit probabilities.
• Breach History: Have I Been Pwned breach archives with total accounts exposed and leaked data types.
• Ransomware Watch: Active extortion claims from RansomLook.
• Security Health Grade (A–F): 100-point posture scoring with an executive summary.

Real-time network diagnostic for any client or target IP:

• Routing & ASN Intelligence: Upstream carrier, ASN classification (residential ISP vs cloud hosting / VPN vs Tor exit).
• Threat Feed Interception: Instant check against abuse.ch threat lists and Spamhaus DROP criminal network blocks.
• Subsea Infrastructure Adjacency: Nearest physical undersea cable landing station.
• Tripwire Diagnostic: Flags connections routing through malicious subnets, hostile anonymizers, or compromised nodes.

Protective DNS endpoint with machine learning DGA detection and DNS-over-HTTPS:

• DGA Botnet Entropy Scorer: Shannon entropy scoring flags algorithmic botnet domains (entropy > 3.65 on domain labels).
• Instant Sinkhole Response: Sinkholes confirmed malware C2 and phishing domains to 0.0.0.0 in <15ms.
• RFC 8484 Standard: Full binary wire format (application/dns-message) and JSON DoH at /dns-query.

Real-time macro-level internet blackout and outage telemetry:

• CAIDA IODA & RIPE RIS: Monitors routing table withdrawals, BGP leaks, and country-scale transit anomalies.
• Impact Analysis: Severity scoring, transit volume loss percentage, and affected ASNs.

Deep package dependency and license audit via Google deps.dev & OSV.dev:

• Multi-Ecosystem: PyPI, npm, Go, Cargo (Rust), and Maven (Java).
• Vulnerability Mapping: Direct correlation with published OSV and GHSA security advisories.
• License Risk Analysis: Detects copyleft / restrictive licenses (AGPL, GPL, LGPL) vs permissive licenses.

Audit domain employee breach exposures and credential safety:

• Zero-Knowledge k-Anonymity: Hashes passwords client-side via SHA-1; only transmits the 5-character prefix (never transmits plaintext or full hashes).
• Ransomware Extortion Tracking: Cross-references corporate domains against active ransomware gang extortion catalogs.

Deploy deceptive decoy assets into private git repos, configuration files, and databases:

• Decoy Formats: Fake AWS IAM access keys (.aws/credentials), Postgres database URIs, and 1x1 tracking beacons.
• Instant Intrusion Alarms: Captures intruder IP, ASN, carrier, reverse geolocation, and user-agent the instant a token is probed.

Deterministic, actionable mitigations for CVEs, malicious IPs, and DGA botnets:

• 3-Bullet Executive Card: What happened, Who is impacted, What to do right now.
• 60-Second Shell Fixes: Drop-in shell commands for iptables, nftables, Suricata, and Windows Firewall.

Planetary geospatial registry of frontier computing hubs:

• Hyperscaler Superclusters: AWS US-East, GCP Council Bluffs, Azure Boydton, Meta Prineville, OCI Abilene.
• Semiconductor Fabs: TSMC Tainan, ASML Veldhoven, Intel Chandler.
• Integrated Globe Layer: Visualized directly on the 3D planetary globe.

ALIBI includes a zero-dependency, type-safe Python client library:

from ittravel import AlibiClient

client = AlibiClient()

# Check IP footprint & threat posture
footprint = client.footprint("1.1.1.1")
print(f"Tier: {footprint.threat_tier}, ASN: {footprint.network.get('asn')}")

# Analyze company tech attack surface
company = client.company_tech("Cloudflare")
print(f"Health Grade: {company.security_grade}, ASNs: {len(company.asns)}")

# Inspect domain via DNS Shield
shield = client.dns_shield("xq7b9kz1m0w8p2r4j6f.biz")
print(f"Verdict: {shield.verdict}, Reason: {shield.dga_reason}")

# Analyze open-source package supply chain
pkg = client.supply_chain("fastapi", ecosystem="pypi")
print(f"Status: {pkg.security_status}, License: {pkg.license_risk}")

ALIBI ships with a production-grade machine learning model (netrisk_model.joblib) trained on real 2026 ThreatFox telemetry:

• Task: Predict the risk percentile of any autonomous system (ASN) hosting new malicious infrastructure.
• ROC-AUC: 0.964 · PR-AUC: 0.941
• Evaluation: Out-of-time evaluation against real-world network routing allocations.
• Detailed metrics, calibration curves, and feature importance available in netrisk_card.json.

Numbers from the snapshot of 10 October 2026 (the live app shows the current ones):

A finding worth knowing: only 11% of the malware servers sit on hosting or VPN networks, about the same as those networks' 11% share of all addresses; 49% are home routers, cameras and other devices hijacked by botnets such as Mozi and Mirai. Blocking data centers alone misses most of them.

Every single number, indicator, and record in ALIBI comes from a verified, publicly available, live 2026 data pipeline.

Generated from sources.yaml by scripts/readme_numbers.py.

All read endpoints are keyless, rate-limited, and return an X-Data-As-Of timestamp header.

Interactive Swagger documentation is available locally at http://localhost:8000/docs.

# Clone the repository
git clone https://github.com/UtkarshOver9000/alibi.git
cd alibi

# Install dependencies using uv
uv sync --all-extras

# Start the development server
uv run uvicorn ittravel.api.app:app --reload --port 8000

# Run full test suite
uv run pytest

Visit http://localhost:8000 in your browser to explore the interactive terminal and 3D globe.

• Contributing Guidelines
• Code of Conduct
• Platform Roadmap
• Security Disclosures

Code is licensed under the MIT License. Data feeds remain under their respective source licenses (see sources.yaml).