User Guide

Operator handbook

Everything you need to run CARIO INTEL — from sign-in to signed PDF dossiers.

What is CARIO INTEL?

CARIO INTEL is an OSINT (Open-Source Intelligence) workstation. You enter a target — email, domain, IP, wallet, username, phone, or organisation — and the platform fans out across dozens of lawful public collectors in parallel to build a complete intelligence dossier with risk scoring, entity graphs, timelines, and a tamper-evident chain of custody.

Every action you take is recorded against a case file. Cases hold evidence, analyst notes, custody events, and exportable PDF reports.

Signing in & requesting access

1
Visit /login and sign in with your operator credentials.
2
If you don't have an account, click Request access and submit your details. An admin will review and provision a login.
3
First-time setup: the root admin (tajubusiness@gmail.com) is auto-promoted to admin the first time their account is created in the backend user console. All other operators are provisioned from /admin.

Roles: admin manages operators and access requests; analyst uses every investigative module.

Command — running a scan

1
Go to /dashboard.
2
Type your target in the command bar (email, domain, IP, wallet 0x…, username, phone, org name).
3
Click Run investigation or press Enter.
4
The backend fans out 60+ public collectors in parallel (with per-source timeouts so one slow source never blocks the run). Watch the pipeline bar. When it completes, every tab (Overview, Network, Timeline, Findings, Infrastructure, Dossier) populates with real data.
5
A case is automatically created (or updated) for the target. The top 5 findings are written as evidence, and an analyst note records the run metadata.

What runs against each target type:

  • Domain / email: DNS-over-HTTPS (A/AAAA/MX/TXT/NS/SOA/CAA/SRV/DMARC/DKIM/MTA-STS), RDAP, crt.sh certificate transparency, HTTP headers + tech fingerprint, robots.txt / security.txt / sitemap.xml / humans.txt / ads.txt, Wayback availability + CDX snapshot count, urlscan.io public, Mozilla HTTP Observatory, HackerTarget hostsearch / dnslookup / reverseiplookup / aslookup / geoip / httpheaders, GDELT news, OpenCorporates, Wikipedia + Wikidata, Hacker News Algolia, Reddit, GitHub repo mentions, DuckDuckGo Instant, Common Crawl, OpenSanctions.
  • IP: RDAP-IP, ip-api.com geo, ipwho.is, BGPView (ASN + prefixes), Shodan InternetDB, GreyNoise community, HackerTarget reverse-IP + geoip.
  • Username: GitHub, GitLab, Bitbucket, Keybase, DEV.to, StackExchange, Hacker News profile, Reddit profile, Mastodon, plus Sherlock-style probes across Twitch, YouTube, Instagram, TikTok, Pinterest, Medium, Spotify, SoundCloud, Steam, Vimeo, Patreon, Behance, Dribbble, Flickr, Lobsters, ProductHunt, Telegram, Twitter/X, Threads, Bluesky, Replit, CodePen.
  • Email: XposedOrNot breach analytics, Gravatar, disposable-provider heuristic, GitHub login search, plus the first 12 Sherlock probes on the local part.
  • Wallet (ETH): Ethplorer, ENS reverse, Blockchair. (BTC): Blockstream Esplora, Blockchair.
  • Phone: country-code classification + GDELT news mentions.
  • Organization: Wikipedia, OpenCorporates, GDELT news, HN, Reddit, GitHub.
  • Universal (every target): DuckDuckGo Instant, Wikidata, Common Crawl, OpenSanctions, GDELT, and a 13-link investigator pivot bundle (Google / Bing / Yandex, Archive.org + archive.today, Google dorks, Have-I-Been-Trained, IntelX, Shodan, Censys, FOFA).

Investigations & case management

The /investigate module is the workspace for active cases.

1
Click New to create a case manually (title, target, classification).
2
Select any case in the left rail to load its tabs: Evidence, Analyst Notes, Chain of Custody, Case Summary.
3
Use the search box to filter cases by ID, target, title, or tag.
4
Change a case's status (Active / Pending review / Closed / Archived) from the status dropdown in the case header.

All cases are also browsable as a flat index at /cases with evidence and note counts.

Evidence & analyst notes

1
In a case, open the Evidence tab and click Add evidence.
2
Choose a kind (URL, IOC, screenshot, transcript, doc, file), label it, cite the source, and paste the content.
3
Each evidence item gets a deterministic fingerprint hash and a collection timestamp.
4
Add tags with the tag button. Tags are searchable.
5
Open the Analyst Notes tab to write free-form analytical narrative. Pin notes you want at the top.

Chain of custody

Every mutation (case created, evidence added/tagged/deleted, note added, status changed, scan run, export) appends a custody event. Each event is hashed against the previous one, forming a tamper-evident chain.

The case header shows a CHAIN VERIFIED or CHAIN BROKEN badge. The full ledger is in the Chain of Custody tab.

Relationship graph

/graph renders all entities discovered for the current scan as an interactive node-link diagram. Click any node to inspect it on the dashboard's right rail.

Timeline

/timeline shows every dated event the collectors surfaced — breach dates, registration dates, on-chain activity, archived snapshots — in chronological order, colour-coded by severity.

Threat Center

/threats aggregates severity-ranked findings across all active cases.

Live monitoring

/monitor streams the public-source firehose (Hacker News, Wikipedia recent changes, GitHub public events) plus collector health probes. Use the Pause button to freeze the feed for review.

GEOINT

/geo plots geolocation data from the most recent scan (IP geo, ASN regions, organisational addresses).

Source registry

/sources lists every collector with its current health, latency, and HTTP status. Toggle a source to scope it out of future scans.

Reports & PDF export

Three places can export a signed PDF dossier:

1
Command / Dashboard → Export PDF emits a scan dossier with findings, entities, timeline, and collector telemetry.
2
Investigations → Export dossier on a case emits a full case file (evidence ledger, notes, custody chain).
3
Reports (/reports) → Export PDF emits the active case dossier.

PDFs are generated locally from structured data — they do not leave your browser until you save them, and they render correctly regardless of theme.

AI analyst

/assistant is a conversational copilot trained on the current case context. Ask it to summarise findings, draft narrative paragraphs, or suggest next collection steps.

Analysts

/team lists the operators who have access to this workspace.

Admin control room

Admins (visible only to tajubusiness@gmail.com and other admin roles) get a /admin link in the sidebar to:

  • Provision new operator logins directly.
  • Review pending access requests and approve or reject them.
  • Delete user accounts.

Settings

/settings holds workspace preferences and integration toggles.

Troubleshooting

  • PDF didn't download — make sure pop-up / download blockers aren't intercepting browser saves. The browser console will log the underlying error if any.
  • Scan returned errors for some sources — public collectors rate-limit, time out, or block edge worker IPs. Each source has a 4.5s timeout and runs in parallel so one bad source can never kill the run. Re-run after a minute, or open /sources and re-probe.
  • Can't find a case — cases are listed in three places: the left rail in /investigate, the flat index at /cases, and inside any export filename (INV-YYYY-####).
  • Stuck on a blank screen after login — hard refresh (Cmd/Ctrl + Shift + R). The app auto-clears cached chunks on next load.