🗺️ The Full Map 🏯

🏯 ninja.ing — The Intelligence Mesh // niko: one person built all of this. yes, really. 🤯 │ ├── 📡 ninjasignal.ninja — Cyber Threat Intelligence 🔥 LIVE // niko: the mothership. 83 windows. the UI has a UI. │ ├── 🏠 / — Threat globe + dashboard │ ├── 🔐 /login — SSO identity provider (IDAM authority) SSO │ ├── 📝 /signup — Registration (admin approval required) │ ├── 🔑 /reset — Password reset │ ├── ⚙️ /admin — Users, Health, Password, Security, Audit, IDAM ADMIN │ ├── 🎭 /theatre — Threat Theatre: 3D Three.js galaxy (WASD fly-into, bloom, risk cloud) 🌌 PUBLIC // niko: it's like Google Earth but for hackers │ ├── 📊 /signalhld — High-level design document │ ├── 🔍 /spektr — Ninja Spektr TI search engine 🔎 PUBLIC // niko: Google for hackers. but cooler. │ ├── 🔗 /auth/sso — SSO entry point for cross-app auth │ ├── 🤖 /api/ml/* — Risk, communities, centrality, GCN/GAT, forecast │ ├── 🧬 /api/twins/* — Adversary digital twins + war gaming │ ├── 📡 /api/graph/* — Graph queries, search, stats │ ├── 🔍 /api/kql/* — KQL detection rule generator │ ├── 🧠 /api/search/* — Semantic search (LanceDB + TF-IDF hybrid) │ ├── 🗺️ /api/heatmap/* — H3 hexagonal geo heatmaps + APT overlay │ ├── ⚗️ /api/causal/* — DoWhy causal inference (4 CTI scenarios) │ ├── 📝 /api/extraction/* — LLM CTI entity extraction + graph commit │ ├── 🧬 /api/adversary/dna — Adversary Behavioral DNA (18-dim fingerprinting) 💀 NEW // niko: we fingerprint YOUR fingerprints │ ├── 🧬 /api/adversary/dna/{ip} — Single IP behavioral profile + narrative │ ├── 🔗 /api/adversary/clusters — Behavioral clustering (same operator detection) │ ├── 📝 /api/adversary/narratives — Auto-generated threat narratives │ ├── ⚖️ /api/adversary/compare — Compare two IPs (cosine similarity verdict) │ ├── 🎯 /api/attribution/* — ORIGAMI Attribution Engine (Diamond Model, temporal, infrastructure) 🗺️ NEW // niko: name and shame, but with math │ ├── 🌌 /api/galaxy/data — 3D galaxy visualization data (nodes, edges, labels) NEW │ ├── 🌌 /api/galaxy/node/{name} — Galaxy node drill-down detail │ ├── 📉 /api/diff/summary — Threat Diff changelog (1d/7d/30d/90d windows) NEW │ ├── 📉 /api/diff/detail/{category} — Detailed diff by category │ ├── 📋 /api/briefing/generate — CISO Briefing (executive threat report JSON) NEW │ ├── 📋 /api/briefing/html — CISO Briefing (print-ready HTML) │ ├── 🐦 /api/tweets/* — Auto-tweet bot (queue, post, history) NEW │ ├── 📊 /api/access/intel — Access intelligence + threat level assessment │ ├── 📈 /api/traffic/* — Live traffic analytics (all domains) │ ├── 📤 /api/upload — STIX/MISP bundle upload │ ├── 📄 /intel/cve/{id} — SEO honeypot: per-CVE public pages (3,869 pages) 🕷️ PUBLIC // niko: 4,070 pages Google can't resist indexing │ ├── 👤 /intel/actor/{name} — SEO honeypot: per-actor public pages (195 pages) PUBLIC │ ├── 🌐 /ws/threats — Real-time threat WebSocket ⚡ │ └── 🌐 /ws/telemetry — SIEM telemetry WebSocket ⚡ │ ├── 🌍 ninjafusion.ninja — Geopolitical Intelligence Fusion 🌐 LIVE // niko: 80+ ingesters. it eats the entire internet for breakfast. │ ├── 🏠 / — Dashboard + 68 source fusion view │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 📰 /sitrep — Free public situation report (SEO) 📡 PUBLIC // niko: free intel. you're welcome. 🎁 │ ├── 🤖 /api/ml/* — Risk propagation, communities, forecast │ ├── 🧬 /api/twins/* — Adversary digital twins │ ├── 🎭 /theatre — Threat Theatre (interactive Canvas2D actor map) NEW │ ├── 📊 /api/social/* — Social media intelligence feeds │ └── 🌐 /ws/threats — Real-time intel WebSocket │ ├── 🔪 ninjaraz0r.ninja — Graph-Native SIEM + EDR 🦀 LIVE // niko: a SIEM written in Rust. because why not. │ ├── 📊 / — SIEM dashboard (via Signal UI) │ ├── 🦀 /agents/* — Rust EDR agent management │ ├── 🎯 /rules/* — Auto-generated detection rules (33 built-in) │ ├── 🔗 /cross-node/* — Cross-node ransomware correlation │ ├── 🗺️ /assets/* — AssetMapper + BFS blast radius │ └── ⚠️ /alerts/* — 5-phase kill chain alerts │ ├── 🕵️ ninjanexus.ninja — OSINT Investigative Intelligence 🔎 LIVE // niko: follow the money. always follow the money. 💸 │ ├── 🏠 / — Investigation board + entity graph │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 🔍 /api/investigate/* — Case management + entity pinning │ ├── 🏦 /api/financial/* — Money flow tracing + UBO resolution │ ├── 🚢 /api/sanctions/* — Sanctions screening (OpenSanctions + OFAC) │ ├── 🏝️ /api/offshore/* — ICIJ Offshore Leaks integration │ └── 🤖 /api/ml/* — Suspicion propagation + network detection │ ├── 💰 ninjaken0bi.ninja — Financial Intelligence 📈 LIVE // niko: crypto, stocks, forex — and it tells you when things smell weird │ ├── 🏠 / — Dashboard + ticker bar + globe │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 📈 /api/market/* — Real-time crypto/stocks/forex │ ├── 🧠 /api/ml/* — Price prediction + anomaly detection │ ├── 💬 /api/sentiment/* — ApeWisdom + RSS VADER analysis │ └── 📊 /api/portfolio/* — Portfolio risk + correlation matrix │ ├── 🪪 1d.ninja.ing — Identity Intelligence 👤 LIVE // niko: finds your shadow admins before the red team does │ ├── 🏠 / — Identity dashboard + AD graph │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── ⚔️ /api/paths/* — BFS attack path analysis │ ├── 🎫 /api/kerberos/* — Kerberoasting + AS-REP roasting │ ├── 👤 /api/identities/* — Identity risk scores + shadow admins │ └── 📥 /api/import/* — BloodHound ZIP, LDAP, Azure AD, CSV ingest │ ├── 🤖 ninjav0id.io — V: Autonomous Defensive Cyber Agents 🛡️ LIVE // niko: three AIs that argue about whether to quarantine your laptop │ ├── 🏠 / — Agent control panel + mission board │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 🟢 /api/agents/sentinel — Alert triage + confidence scoring │ ├── 🟡 /api/agents/warden — Automated containment + isolation │ ├── 🟣 /api/agents/spectre — Threat hunting + forensic collection │ ├── 📋 /api/playbooks/* — 8 IR playbooks (SOAR-style) │ └── 🔗 /api/connectors/* — Raz0r + Signal + Azure AD │ ├── 🔮 ninjav0id.io — V0id: Predictive Sentiment Intelligence (landing page + ecosystem hub) 🧿 LIVE // niko: it predicted that tariff announcement 3 days early. just saying. │ ├── 🏠 / — Landing page (public) / Oracle dashboard (authenticated) │ ├── 🗺️ /ninjatone — ninjaTONE daily intelligence briefing (public, free) 📰 // niko: the world's vibes, distilled into one number 🧿 │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 🧿 /api/oracle — Composite 0-100 geopolitical score │ ├── 📰 /api/sentiment/* — GDELT + RSS + Reddit feeds │ ├── 📈 /api/economic/* — FRED indicators + correlation │ ├── 🤖 /api/ml/* — Anomaly detection + topic clustering │ ├── 🛡️ /v — V0id Agents: Sentinel, Warden, Spectre (autonomous defense) │ └── 🌌 /ninjatone#galaxy — 3D Galaxy: Three.js point cloud of 1M+ threat entities 🌠 NEW // niko: it's basically Elite Dangerous for threat data │ ├── ⚙️ antos.ninja.ing — AI-Orchestrated DevSecOps 🐜 LIVE // niko: 17 tools, 1 pipeline, 0 human approvals needed │ ├── 🏠 / — 8-stage pipeline dashboard (17 tools, Claude AI triage) │ └── 📊 /traffic — Cloudflare traffic analytics (all 7 zones) │ ├── 🛡️ gitair.ninja — Git Security Scanning 🔍 LIVE // niko: it finds your .env files before the bad guys do │ └── 🏠 / — Git repository security scanner + secret detection │ ├── 🔐 ninjav0id.io/knox — Secrets, Privacy & Crypto — 金庫 🔑 SOON // niko: AES-GCM + ChaCha20 + SHA3 + KEM. knox doesn't play. │ ├── 🔑 /knox/vault — Encrypted secrets vault (Fernet, machine-bound) │ ├── 🛡️ /knox/crypto — Crypto toolkit (AES-GCM, ChaCha20, SHA3, Ed25519, KEM) │ ├── 👁️ /knox/privacy — PII detection + anonymisation (13 types) │ ├── ✳️ /knox/passwords — Password + passphrase generator with strength meter │ ├── ⏱️ /knox/authenticator — TOTP authenticator (RFC 6238) │ └── 📜 /knox/audit — Chain-hashed tamper-evident audit log │ ├── 💬 ninjasocial.ninja — Threat Intel Collaboration 🐦 LIVE NEW // niko: Twitter for threat analysts. minus the doomscrolling. ok maybe some doomscrolling. │ ├── 🏠 / — Channel feed + DMs + NATS live TI stream │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 📢 /channels/* — 6 default channels (general, threat-intel, IR, detection-eng, sitrep, alerts) │ ├── 💌 /dm/* — Encrypted direct messages │ ├── 🔍 /api/ioc/* — Auto-IOC detection in messages │ └── 🌐 /ws/messages — Real-time WebSocket messaging │ ├── 🎖️ warroom.ninja — Incident War Room 🔴 LIVE NEW // niko: LiveKit video + shared timelines. it's like Zoom but everyone's stressed. │ ├── 🏠 / — Room dashboard + breach containment tracker (8 phases) │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 🎥 /room/* — LiveKit video conferencing rooms │ ├── 📋 /playbooks/* — 4 IR playbooks (ransomware, data breach, DDoS, insider threat) │ ├── 🎯 /ioc/* — IOC panel + Signal enrichment │ └── 📡 /ws/alerts — NATS alert feed WebSocket │ ├── ⚖️ ninja.ing/ninjasabaki — 裁き Vulnerability Triage & Remediation ⚔️ LIVE NEW // niko: finally a vuln tool that doesn't make you want to cry. mostly. │ ├── 🏠 / — Triage dashboard + priority scoring (8-factor) │ ├── 🔐 /login — Auth (SSO → Signal) │ ├── 📥 /api/import/* — Multi-scanner ingest (Nessus/Qualys/Tenable/Inspector) │ ├── 🎯 /api/triage/* — Auto-FP detection (4 rules) + coverage gap analysis │ ├── 🔟 /api/top10 — Top 10 generator (prioritised remediation list) │ └── 🎫 /api/servicenow/* — ServiceNow integration (auto-ticket + resolver routing + email) │ ├── 🏯 Los Alamos Range — 射場 Agentic Live Fire Cyber Range 🎲 SOON // niko: LLM agents play war games. the ELO system is brutal. 💀 │ ├── ⚔️ /arena — Red vs Blue wargaming arena + tick engine │ ├── 👹 /kage, /oni, /yurei — Red Trinity: LLM-driven adversary agents │ ├── 🛡️ /blue — Blue team: V0id agents (Sentinel/Warden/Spectre) │ ├── 🏆 /scoreboard — ELO scoring + kill chain heatmap │ ├── 🌐 /environment — 5 enterprise templates (corp/cloud/ICS/finance/gov) │ └── 🎲 /workbench — Chimera randomizer + chaos mutations │ ├── 🦞 NinjaClaw — Hardened CLI Security Agent 🖥️ PyPI // niko: pip install ninjaclaw. that's it. that's the pitch. │ └── 🔧 CLI — 10 scanners, CIS rules, Claude AI assess, Signal intel, zero attack surface │ ├── 🏯 ninja.ing — Showcase & Documentation 📚 LIVE // niko: the gift shop is this way → │ ├── 🏠 / — The Intelligence Mesh landing page 🕸️ │ ├── 🗺️ /sitemap.html — You are here 📍 // niko: inception. a map of the map. │ ├── 🔐 /login.html — Showcase auth gate │ ├── 📄 /exec-summary.html — Executive summary (why this exists) AUTH │ ├── 💼 /ma-guide.html — Insight³ technical deep dive AUTH │ ├── 📓 /diary.html — Development diary (the whole journey) 📖 AUTH │ ├── 💚 /niko.html — Niko's Corner (dispatches from the front) 🐱 NEW // niko: my page! finally! about time. │ ├── ⚔️ /philosophy.html — Ninja Philosophy manifesto (BSG Razor aesthetic) 🗡️ NEW │ └── 🎸 /tonelab/ — ninjaTONE Lab (14 tone labs) 🎵 // niko: guitar nerd alert. proceed with caution. 🎶 │ ├── ⚔️ raz0r.io — Philosophy & Contact 🗡️ LIVE NEW // niko: "first rule of ninja club is you DO talk about ninja club" │ └── 📬 / — Ninja Philosophy + contact form (FormSubmit → [email protected]) │ └── 🔧 Infrastructure — The plumbing 🪠 // niko: the stuff nobody sees but everything breaks without ├── 🗄️ Neo4j 5.x + GDS 2.22 — Graph database (8 instances, shared prod server) ├── 🐍 FastAPI + Python 3.14 — 13 API backends ├── ⚛️ Next.js 16 + React 19 — 14 UI frontends (Tailwind 4) ├── 🔒 Caddy 2 — Reverse proxy + TLS (13 domains, one instance) ├── ☁️ Cloudflare — DNS + proxy + origin certs (7 zones) ├── 🐳 Docker Compose — 30+ containers, one network // niko: docker ps is a scroll fest 📜 ├── 🦀 Rust — Raz0r EDR agent (ETW + AMSI + memory scanning) ├── 🧠 ML Stack — GCN/GAT, Hawkes, GraphSAGE, Louvain, DoWhy, LanceDB ├── 📡 NATS JetStream — Event bus (9 subject hierarchies, cross-platform pub/sub) ├── 🔑 SSO / IDAM — Signal as identity provider, cross-domain auth ├── 🔴 Redis 7 — Presence, sessions, pub/sub (Social + War Room) ├── 🎥 LiveKit — WebRTC video conferencing (War Room) └── 🏗️ Hetzner Dedicated — Two servers, WireGuard tunnel, zero cloud bills 💸 // niko: two servers to rule them all 💍
17 platforms, 13 domains, 13 APIs, 14 UIs, 10 graphs, 1 engineer, 0 excuses. 🚀🔥💀 // niko: "is this a startup or a cry for help?" — yes.