A single live map that fuses open-source intelligence across air, sea, land, and space. Every layer is driven by public real-time feeds, proxied and cached at the edge, and rendered as a continuously updating situational picture in the browser — no login, no installs.
OSINTMesh is built for open-source intelligence and situational awareness. It aggregates freely available real-time feeds — community ADS-B, AIS, GTFS-RT, government hazard APIs, and orbital element sets — behind a unified edge layer, then presents them on one interactive Leaflet map with per-layer toggles, filtering, detail panels, and track playback.
The complete set of toggleable tracking layers available in the map's Layer Control, grouped by domain.
Every layer is powered by a public or community feed. OSINTMesh proxies each one through its own edge route to normalize formats, add CORS, and cache responses — it never stores or resells the underlying data.
| Layer | Data source | What it provides |
|---|---|---|
| Aircraft (ADS-B) | adsb.fi / community ADS-B | Live positions, callsign, altitude, speed, squawk, military & emergency flags. |
| Flight routes | adsbdb | Origin/destination airport lookup and airline resolution from callsign. |
| METARs | Aviation Weather Center | Airport surface weather observations. |
| PIREPs | Aviation Weather Center | Pilot-reported turbulence, icing, and sky conditions. |
| SIGMETs / AIRMETs | Aviation Weather Center | Significant meteorological hazard polygons. |
| TFRs (US temporary) | FAA | Temporary flight restriction areas across the US. |
| No-fly zones (worldwide) | OpenAIP | Standing restricted / prohibited / danger airspace polygons, viewport-scoped globally. |
| Airport delays | FAA NAS Status | Ground stops, ground delays, and airspace flow programs. |
| Layer | Data source | What it provides |
|---|---|---|
| Ships (AIS) | AISStream.io | Live vessel positions, names, MMSI, type, destination via persistent WebSocket. |
| Vessel tracks | AISStream.io (server-retained) | Rolling path history accumulated per vessel while the stream is watching. |
| Ocean buoys | NOAA NDBC | Wave height, sea temperature, and wind observations. |
| Tides | NOAA CO-OPS | Tidal station predictions and water levels. |
| Stream gauges | USGS Water Services | River/stream discharge and gauge height. |
| Icebergs | US National Ice Center | Tracked iceberg positions. |
| Layer | Data source | What it provides |
|---|---|---|
| Transit (bus, tram, rail, subway, ferry) | Transitland + agency GTFS-RT | Real-time vehicle positions across hundreds of metro agencies worldwide. |
| Amtrak | Amtrak GTFS-RT | Live long-distance and regional train positions across the US. |
| Traffic cameras | Caltrans, DriveBC, HK Transport Dept, Windy | Live roadside and regional webcam stills. |
| YouTube live cams | Curated YouTube livestreams | Embedded public live camera feeds keyed to locations. |
| Layer | Data source | What it provides |
|---|---|---|
| Earthquakes | USGS | Real-time global seismic events with magnitude and depth. |
| Weather alerts + IPAWS | NWS / api.weather.gov | US watches, warnings, and advisories. Non-weather IPAWS messages (AMBER, Blue Alert, Civil Danger, Civil Emergency, HazMat, Shelter-in-Place, Fire, Evacuation, 911 Outage, Nuclear, Radiological, Volcano, etc.) are decoded from the full SAME event-code taxonomy and each carries a plain-English 'what to do' impact line. |
| IPAWS-only derived layer | NWS relay, client-filtered | Toggle isolates IPAWS-tagged emergency messages from weather noise. Auto-suppressed when the general Weather alerts layer is on to prevent double-render. |
| FEMA IPAWS archive (Copilot recall) | FEMA IPAWS Archived Alerts (keyless, ~24–48h lag) | Historical WEA lookups — decoded WEAHandling (Imminent Threat / AMBER / Public Safety / Presidential / Test), 90-char CMAMtext, 360-char CMAMlongtext, SAME codes. Ask the Copilot 'was there an AMBER alert last week in X?'. Not a live map layer (live IPAWS-OPEN is COG-authenticated). |
| Hurricane forecast cones | NOAA NHC | Active tropical cyclones with 5-day forecast cone, center-line track, and current storm position with Saffir–Simpson category. |
| Severe weather outlooks | NOAA SPC (Storm Prediction Center) | Day 1–3 categorical severe thunderstorm risk polygons (Marginal → High), Day 1 tornado probability contours, and Day 4–8 probabilistic 'any severe' outlooks — all folded into one toggle. Codes (TSTM/MRGL/SLGT/ENH/MDT/HIGH and % probabilities) are decoded into plain-English impact sentences. |
| Natural disasters (global) | GDACS | Global earthquakes, cyclones, floods, volcanoes, and droughts with severity. |
| Wildfires, volcanoes & icebergs | NASA EONET | Tracked wildfires, storms, volcanic activity, and sea/lake ice. |
| Air quality | Open-Meteo Air Quality | PM2.5, PM10, and AQI grids. |
| Lightning | Blitzortung-derived feed | Recent lightning strike locations. |
| Weather radar | RainViewer | Animated precipitation radar tiles. |
| Ocean buoys | NOAA NDBC | Latest buoy wave, temperature, and wind observations. |
| Layer | Data source | What it provides |
|---|---|---|
| ISS & Tiangong | Open Notify / TLE propagation | Live space station ground tracks. |
| Starlink & satellites | CelesTrak TLE | Orbital element sets propagated to live positions. |
| Rocket launches | The Space Devs (Launch Library 2) | Upcoming and recent orbital launches. |
| Aurora forecast | NOAA SWPC | Auroral oval probability and geomagnetic activity. |
| Solar activity | NOAA SWPC | GOES X-ray flux, planetary K-index, and solar wind speed. |
| Satellite passes | CelesTrak TLE | Predicted overhead passes propagated from orbital elements. |
| Near-Earth objects | NASA NeoWs | Close-approach asteroids and comets. |
| Radiosondes & ham balloons | SondeHub / APRS | Weather balloon and amateur high-altitude balloon tracks. |
| Layer | Data source | What it provides |
|---|---|---|
| Dams & reservoirs | USACE National Inventory of Dams + OSM | Dam locations with live US reservoir levels from USGS gauges. |
| Reactor status (live) | US NRC | Daily percent-power status for US nuclear reactors. |
| Grid demand (live) | US EIA | Balancing-authority electricity demand in megawatts. |
| Power plants, solar & nuclear sites | OpenStreetMap (Overpass) | Generation sites and facility geometry from crowd-sourced OSM data. |
| US-ISO fuel mix + balance | US EIA v2 (rto/region-data + fuel-type-data) | Per-ISO (CAISO/ERCOT/PJM/MISO/SWPP/ISO-NE/NYISO) live fuel mix plus actual demand vs day-ahead forecast and net interchange (import/export). Powers the grid-forecast-stress anomaly rule (|Δ%| ≥5 notable, ≥10 high, ≥15 critical). |
| ENTSO-E (EU grid) | ENTSO-E Transparency Platform | European generation, load, and cross-border flows. |
| NRC nuclear operating events | US NRC event notification reports | Public reactor event notifications with a dedicated anomaly rule. |
| Substations, transmission lines & pipelines | OpenStreetMap (Overpass) | Electrical grid and oil/gas infrastructure geometry. |
| Hospitals | OpenStreetMap (Overpass) | Global hospital and medical facility locations. |
| Layer | Data source | What it provides |
|---|---|---|
| Cyber threats (live) | abuse.ch Feodo Tracker + SANS ISC | Malware C2 IPs and top attacking sources, geolocated via ip-api. |
| DDoS attacks (Cloudflare) | Cloudflare Radar | Layer 3/4 and Layer 7 attack flows between origin and target countries. |
| Certificate transparency (Copilot) | crt.sh | On-demand lookup of SSL certificates issued for a domain — surfaces new subdomains and issuer changes for infrastructure monitoring. Ask the Copilot 'any new certificates on example.com?'. |
| IP exposure (Copilot) | Shodan InternetDB | Keyless IP reputation lookup — open ports, hostnames, tags, and known CVEs. Ask the Copilot 'what's exposed on 8.8.8.8?' or 'is this IP malicious?'. Observation only; presence is not proof of compromise. |
| IP noise vs. threat (Copilot) | GreyNoise Community | Classifies an IP as internet background noise, known-benign service (RIOT: CDNs, crawlers, cloud infra), or confirmed malicious scanner. Pairs with Shodan InternetDB to separate real threats from routine internet scanning. Ask the Copilot 'is this IP just noise or a real threat?'. |
| CISA Known Exploited Vulnerabilities (KEV) | CISA KEV catalog | US CISA's list of CVEs known to be exploited in the wild. |
| CISA ICS advisories | CISA Industrial Control Systems advisories | Advisories for ICS/OT vendors with CVE extraction and anomaly integration. |
| CERT-EU advisories | CERT-EU RSS | EU peer to CISA KEV/ICS; drives the cyber-certeu-advisory anomaly. |
| GitHub Security Advisories (GHSA) | GitHub advisory database (keyless) | Ecosystem-tagged (npm, PyPI, Maven, Go, RubyGems, Composer, NuGet, Rust). Drives the cyber-ghsa-advisory anomaly. |
| Layer | Data source | What it provides |
|---|---|---|
| News events (global) | GDELT Project | Cross-language event stream; filtered by whole-word conflict relevance and cross-bloc corroborated to reduce editorial bias. |
| Thermal anomalies | NASA FIRMS (VIIRS NOAA-20 / NOAA-21 NRT) | Fire and heat detections used as proxies for strikes, shelling, and industrial fires. |
| Armed conflict events | ACLED | Battles, explosions, and violence against civilians with actor and fatality metadata. |
| Humanitarian crises | ReliefWeb (OCHA) | Active disasters and complex emergencies with crisis names and severity. |
| Editorial RSS mesh | 41 outlets across editorial blocs | Curated RSS ingest used to fill GDELT extraction gaps and corroborate stories across viewpoints. |
| OSINT handles & threat actors | Curated registry (src/lib/osintHandles.ts) | Named analyst handles, threat actor groups, and arms-system references with provenance metadata. |
| Layer | Data source | What it provides |
|---|---|---|
| Smart search (AI) | Lovable AI Gateway | Resolves natural-language queries ("planes over Tokyo", "EVER GIVEN") to a map location and layer. |
| Search fallback | OpenStreetMap Nominatim | Deterministic geocoder used when AI is unavailable, so search always works. |
The browser renders the map and polls domain-specific hooks. Each hook calls an edge API route which fetches the upstream feed, caches it, and returns normalized JSON/GeoJSON with CORS. Warm worker instances keep hot data (like the AIS WebSocket) alive between requests.
Browser (React + Leaflet) │ polling hooks · viewport-driven fetch ▼ Edge API routes (/api/* on Cloudflare Workers) │ fetch upstream → normalize → cache (KV / Cache API) │ persistent WebSocket for live AIS (warm instance) ▼ Open data feeds ADS-B · AIS · GTFS-RT · NOAA / USGS / NASA · CelesTrak · FAA …