Back to map
OSINTMesh
Project documentation

OSINTMesh

A single live map that fuses open-source intelligence across air, sea, land, and space. Every layer is driven by public real-time feeds, proxied and cached at the edge, and rendered as a continuously updating situational picture in the browser — no login, no installs.

What it is

Overview

60+
live tracking layers
45+
open data sources
7
domains: air · sea · land · space · infra · cyber · conflict

OSINTMesh is built for open-source intelligence and situational awareness. It aggregates freely available real-time feeds — community ADS-B, AIS, GTFS-RT, government hazard APIs, and orbital element sets — behind a unified edge layer, then presents them on one interactive Leaflet map with per-layer toggles, filtering, detail panels, and track playback.

Capabilities

Features

Air traffic intelligence

Live ADS-B aircraft with callsign, ICAO24, altitude, speed and heading. Automatic airline resolution, military and emergency squawk highlighting, origin/destination route lookup, and full trace playback per aircraft.

Maritime tracking

Live AIS vessels via a persistent server-side WebSocket, enriched with static ship data (name, type, destination, draught) and a server-retained rolling track for any selected vessel.

Ground transit

Real-time buses, trams, subways, regional rail and ferries across hundreds of agencies worldwide via Transitland/GTFS-RT, plus dedicated Amtrak coverage, route shapes and stop details.

Space & orbital

ISS and Tiangong ground tracks, Starlink and satellite constellations from TLE propagation, upcoming rocket launches, aurora forecasts and near-Earth object approaches.

Hazards & environment

Earthquakes, weather alerts, wildfires, volcanoes, disasters, air quality, lightning strikes and animated precipitation radar.

Water & weather

Ocean buoys, tide stations, USGS stream gauges, aviation weather (METAR / PIREP / SIGMET) and FAA airport delays.

Live cameras

Roadside and regional webcams from Caltrans, DriveBC, Hong Kong Transport and Windy, plus curated YouTube live streams keyed to locations.

Radio & signals

Weather radiosondes (SondeHub) and amateur high-altitude balloon tracks for upper-atmosphere and signals awareness.

Critical infrastructure

Dams with live US reservoir levels, power plants, substations, transmission lines, pipelines, hospitals, plus live NRC reactor status and EIA grid demand.

Cyber situational awareness

Live malware command-and-control and top attacking sources, plus Cloudflare Radar Layer 3/4 and Layer 7 DDoS attack flows between countries.

AI smart search

Natural-language search resolves places, entities and intents to a map location and layer via Lovable AI, with an OpenStreetMap geocoder fallback so it always works — even without an AI key. Complex queries escalate into the Copilot.

Map Copilot

Conversational agent on Cloudflare Workers AI (llama-3.3-70b) with a two-pass tool-calling loop. Navigates the map, toggles layers, sets filters, runs area briefs, and surfaces anomalies (emergency squawks, military activity, quake swarms) deterministically.

Conflict Intelligence

Live theater scoring fusing GDELT news, NASA FIRMS thermal anomalies, ACLED armed events, and ReliefWeb crises across 41 editorial-bloc feeds with cross-bloc corroboration, whole-word relevance filtering, and freshness guards.

30-day History

Region-scoped history pipeline (D1 hot store + R2 cold archive) with 3-sigma anomaly baselines, a dedicated /history dashboard, and periodic ingest via Cloudflare Cron Triggers.

Health & usage dashboards

/health probes every proxy endpoint with widened latency bands to avoid false "degraded" flags; /usage surfaces live Cloudflare Workers, KV, D1, R2 and Vectorize consumption.

PWA & responsive UI

Installable Progressive Web App with themed favicon and offline manifest served from the Worker. Tuned for mobile, tablet and desktop; the in-session playback bar hides on mobile to preserve map real estate.

Shared-access gate

Optional timing-safe shared-password gate with a signed HttpOnly cookie so the deployed instance can be kept private without full auth infrastructure.

Interaction model

  • • Per-layer toggle control grouped by domain
  • • AI natural-language search + callsign / ICAO24 / squawk lookup
  • • Filter panel for narrowing the visible set
  • • Detail panels for aircraft, vessels and transit
  • • Track playback and route rendering
  • • Viewport-driven fetching to stay performant
  • • Multiple base map / tile styles
  • • Dark, OSINT-oriented visual system
Every toggle on the map

All Layers

The complete set of toggleable tracking layers available in the map's Layer Control, grouped by domain.

Air

10
  • Aircraft (ADS-B)
  • Aircraft heatmap
  • Callsign labels
  • Emergency squawk highlighting (7500/7600/7700)
  • Military aircraft flagging
  • METARs
  • PIREPs
  • SIGMETs / AIRMETs
  • No-fly zones — FAA TFRs (US) + OpenAIP standing airspace (worldwide)
  • Airport delays

Sea & water

5
  • Ships (AIS)
  • Ocean buoys
  • Tides
  • Stream gauges
  • Icebergs

Land & transit

6
  • Buses
  • Trams / light rail
  • Regional rail
  • Subway / metro
  • Ferries
  • Amtrak

Cameras

5
  • Hong Kong traffic cams
  • DriveBC cams
  • Caltrans cams
  • Windy cams
  • YouTube live cams

Hazards & environment

8
  • Earthquakes
  • Weather alerts
  • Natural disasters
  • Wildfires
  • Volcanoes
  • Air quality
  • Lightning
  • Weather radar

Space & signals

11
  • ISS
  • Tiangong
  • Starlink
  • Satellites
  • Satellite passes
  • Rocket launches
  • Aurora forecast
  • Solar activity
  • Near-Earth objects
  • Radiosondes
  • Ham balloons

Infrastructure

10
  • Dams & reservoirs
  • Power plants
  • Solar farms
  • Nuclear plants
  • Reactor status (live)
  • Grid demand (live)
  • Substations
  • Transmission lines
  • Pipelines
  • Hospitals

Cybersecurity

2
  • Cyber threats (live)
  • DDoS attacks (Cloudflare)

Conflict Intelligence

6
  • Conflict theaters with activity scoring
  • GDELT news events (cross-bloc corroborated)
  • NASA FIRMS thermal anomalies (VIIRS NOAA-20/21)
  • ACLED armed conflict events
  • ReliefWeb humanitarian crises
  • Curated OSINT handles & threat-actor registry
Where the data comes from

Data Sources

Every layer is powered by a public or community feed. OSINTMesh proxies each one through its own edge route to normalize formats, add CORS, and cache responses — it never stores or resells the underlying data.

Air

LayerData sourceWhat it provides
Aircraft (ADS-B)adsb.fi / community ADS-BLive positions, callsign, altitude, speed, squawk, military & emergency flags.
Flight routesadsbdbOrigin/destination airport lookup and airline resolution from callsign.
METARsAviation Weather CenterAirport surface weather observations.
PIREPsAviation Weather CenterPilot-reported turbulence, icing, and sky conditions.
SIGMETs / AIRMETsAviation Weather CenterSignificant meteorological hazard polygons.
TFRs (US temporary)FAATemporary flight restriction areas across the US.
No-fly zones (worldwide)OpenAIPStanding restricted / prohibited / danger airspace polygons, viewport-scoped globally.
Airport delaysFAA NAS StatusGround stops, ground delays, and airspace flow programs.

Sea & water

LayerData sourceWhat it provides
Ships (AIS)AISStream.ioLive vessel positions, names, MMSI, type, destination via persistent WebSocket.
Vessel tracksAISStream.io (server-retained)Rolling path history accumulated per vessel while the stream is watching.
Ocean buoysNOAA NDBCWave height, sea temperature, and wind observations.
TidesNOAA CO-OPSTidal station predictions and water levels.
Stream gaugesUSGS Water ServicesRiver/stream discharge and gauge height.
IcebergsUS National Ice CenterTracked iceberg positions.

Land

LayerData sourceWhat it provides
Transit (bus, tram, rail, subway, ferry)Transitland + agency GTFS-RTReal-time vehicle positions across hundreds of metro agencies worldwide.
AmtrakAmtrak GTFS-RTLive long-distance and regional train positions across the US.
Traffic camerasCaltrans, DriveBC, HK Transport Dept, WindyLive roadside and regional webcam stills.
YouTube live camsCurated YouTube livestreamsEmbedded public live camera feeds keyed to locations.

Hazards & environment

LayerData sourceWhat it provides
EarthquakesUSGSReal-time global seismic events with magnitude and depth.
Weather alerts + IPAWSNWS / api.weather.govUS watches, warnings, and advisories. Non-weather IPAWS messages (AMBER, Blue Alert, Civil Danger, Civil Emergency, HazMat, Shelter-in-Place, Fire, Evacuation, 911 Outage, Nuclear, Radiological, Volcano, etc.) are decoded from the full SAME event-code taxonomy and each carries a plain-English 'what to do' impact line.
IPAWS-only derived layerNWS relay, client-filteredToggle isolates IPAWS-tagged emergency messages from weather noise. Auto-suppressed when the general Weather alerts layer is on to prevent double-render.
FEMA IPAWS archive (Copilot recall)FEMA IPAWS Archived Alerts (keyless, ~24–48h lag)Historical WEA lookups — decoded WEAHandling (Imminent Threat / AMBER / Public Safety / Presidential / Test), 90-char CMAMtext, 360-char CMAMlongtext, SAME codes. Ask the Copilot 'was there an AMBER alert last week in X?'. Not a live map layer (live IPAWS-OPEN is COG-authenticated).
Hurricane forecast conesNOAA NHCActive tropical cyclones with 5-day forecast cone, center-line track, and current storm position with Saffir–Simpson category.
Severe weather outlooksNOAA SPC (Storm Prediction Center)Day 1–3 categorical severe thunderstorm risk polygons (Marginal → High), Day 1 tornado probability contours, and Day 4–8 probabilistic 'any severe' outlooks — all folded into one toggle. Codes (TSTM/MRGL/SLGT/ENH/MDT/HIGH and % probabilities) are decoded into plain-English impact sentences.
Natural disasters (global)GDACSGlobal earthquakes, cyclones, floods, volcanoes, and droughts with severity.
Wildfires, volcanoes & icebergsNASA EONETTracked wildfires, storms, volcanic activity, and sea/lake ice.
Air qualityOpen-Meteo Air QualityPM2.5, PM10, and AQI grids.
LightningBlitzortung-derived feedRecent lightning strike locations.
Weather radarRainViewerAnimated precipitation radar tiles.
Ocean buoysNOAA NDBCLatest buoy wave, temperature, and wind observations.

Space & signals

LayerData sourceWhat it provides
ISS & TiangongOpen Notify / TLE propagationLive space station ground tracks.
Starlink & satellitesCelesTrak TLEOrbital element sets propagated to live positions.
Rocket launchesThe Space Devs (Launch Library 2)Upcoming and recent orbital launches.
Aurora forecastNOAA SWPCAuroral oval probability and geomagnetic activity.
Solar activityNOAA SWPCGOES X-ray flux, planetary K-index, and solar wind speed.
Satellite passesCelesTrak TLEPredicted overhead passes propagated from orbital elements.
Near-Earth objectsNASA NeoWsClose-approach asteroids and comets.
Radiosondes & ham balloonsSondeHub / APRSWeather balloon and amateur high-altitude balloon tracks.

Infrastructure

LayerData sourceWhat it provides
Dams & reservoirsUSACE National Inventory of Dams + OSMDam locations with live US reservoir levels from USGS gauges.
Reactor status (live)US NRCDaily percent-power status for US nuclear reactors.
Grid demand (live)US EIABalancing-authority electricity demand in megawatts.
Power plants, solar & nuclear sitesOpenStreetMap (Overpass)Generation sites and facility geometry from crowd-sourced OSM data.
US-ISO fuel mix + balanceUS EIA v2 (rto/region-data + fuel-type-data)Per-ISO (CAISO/ERCOT/PJM/MISO/SWPP/ISO-NE/NYISO) live fuel mix plus actual demand vs day-ahead forecast and net interchange (import/export). Powers the grid-forecast-stress anomaly rule (|Δ%| ≥5 notable, ≥10 high, ≥15 critical).
ENTSO-E (EU grid)ENTSO-E Transparency PlatformEuropean generation, load, and cross-border flows.
NRC nuclear operating eventsUS NRC event notification reportsPublic reactor event notifications with a dedicated anomaly rule.
Substations, transmission lines & pipelinesOpenStreetMap (Overpass)Electrical grid and oil/gas infrastructure geometry.
HospitalsOpenStreetMap (Overpass)Global hospital and medical facility locations.

Cybersecurity

LayerData sourceWhat it provides
Cyber threats (live)abuse.ch Feodo Tracker + SANS ISCMalware C2 IPs and top attacking sources, geolocated via ip-api.
DDoS attacks (Cloudflare)Cloudflare RadarLayer 3/4 and Layer 7 attack flows between origin and target countries.
Certificate transparency (Copilot)crt.shOn-demand lookup of SSL certificates issued for a domain — surfaces new subdomains and issuer changes for infrastructure monitoring. Ask the Copilot 'any new certificates on example.com?'.
IP exposure (Copilot)Shodan InternetDBKeyless IP reputation lookup — open ports, hostnames, tags, and known CVEs. Ask the Copilot 'what's exposed on 8.8.8.8?' or 'is this IP malicious?'. Observation only; presence is not proof of compromise.
IP noise vs. threat (Copilot)GreyNoise CommunityClassifies an IP as internet background noise, known-benign service (RIOT: CDNs, crawlers, cloud infra), or confirmed malicious scanner. Pairs with Shodan InternetDB to separate real threats from routine internet scanning. Ask the Copilot 'is this IP just noise or a real threat?'.
CISA Known Exploited Vulnerabilities (KEV)CISA KEV catalogUS CISA's list of CVEs known to be exploited in the wild.
CISA ICS advisoriesCISA Industrial Control Systems advisoriesAdvisories for ICS/OT vendors with CVE extraction and anomaly integration.
CERT-EU advisoriesCERT-EU RSSEU peer to CISA KEV/ICS; drives the cyber-certeu-advisory anomaly.
GitHub Security Advisories (GHSA)GitHub advisory database (keyless)Ecosystem-tagged (npm, PyPI, Maven, Go, RubyGems, Composer, NuGet, Rust). Drives the cyber-ghsa-advisory anomaly.

Conflict Intelligence

LayerData sourceWhat it provides
News events (global)GDELT ProjectCross-language event stream; filtered by whole-word conflict relevance and cross-bloc corroborated to reduce editorial bias.
Thermal anomaliesNASA FIRMS (VIIRS NOAA-20 / NOAA-21 NRT)Fire and heat detections used as proxies for strikes, shelling, and industrial fires.
Armed conflict eventsACLEDBattles, explosions, and violence against civilians with actor and fatality metadata.
Humanitarian crisesReliefWeb (OCHA)Active disasters and complex emergencies with crisis names and severity.
Editorial RSS mesh41 outlets across editorial blocsCurated RSS ingest used to fill GDELT extraction gaps and corroborate stories across viewpoints.
OSINT handles & threat actorsCurated registry (src/lib/osintHandles.ts)Named analyst handles, threat actor groups, and arms-system references with provenance metadata.

Search

LayerData sourceWhat it provides
Smart search (AI)Lovable AI GatewayResolves natural-language queries ("planes over Tokyo", "EVER GIVEN") to a map location and layer.
Search fallbackOpenStreetMap NominatimDeterministic geocoder used when AI is unavailable, so search always works.
How it's built

Technology

Framework

TanStack Start v1 (full-stack React 19) with file-based routing, server functions and server routes. Built with Vite 7 and strict TypeScript.

Frontend

React 19, Leaflet for mapping, Tailwind CSS v4 with a semantic OKLCH design system, shadcn/ui components, lucide icons, and TanStack Query for data.

Edge platform

Deployed on Cloudflare Workers (nodejs_compat). API routes proxy upstream feeds and cache in Workers KV, with the Cache API for idempotent GETs and Cron Triggers warming popular regions.

Data & state

Tiered cache: warm-instance Map → Workers KV (minutes–hours TTL) → D1 for structured data (route/vessel metadata, embeddings, 30-day history) → R2 for cold archive. Queues absorb background writes; a Durable Object owns the persistent AIS WebSocket per region.

AI subsystem

Lovable AI Gateway powers smart search, situational briefs, and reference embeddings. Cloudflare Workers AI (llama-3.3-70b, bge-base-en-v1.5) runs the Map Copilot and edge embeddings. Every AI path degrades to a deterministic rule-based fallback.
TanStack StartReact 19TypeScriptVite 7Tailwind CSS v4shadcn/uiLeafletTanStack QueryCloudflare WorkersWorkers KVCloudflare D1R2QueuesDurable ObjectsWorkers AIVectorizeCron TriggersWebSocketsPWA
How it fits together

Architecture

The browser renders the map and polls domain-specific hooks. Each hook calls an edge API route which fetches the upstream feed, caches it, and returns normalized JSON/GeoJSON with CORS. Warm worker instances keep hot data (like the AIS WebSocket) alive between requests.

Browser (React + Leaflet)
  │  polling hooks · viewport-driven fetch
  ▼
Edge API routes  (/api/*  on Cloudflare Workers)
  │  fetch upstream → normalize → cache (KV / Cache API)
  │  persistent WebSocket for live AIS (warm instance)
  ▼
Open data feeds
  ADS-B · AIS · GTFS-RT · NOAA / USGS / NASA · CelesTrak · FAA …