GitHub RadarBlue team tool
Defensive engagement & threat intelligence research laboratory. Converts inbound scam emails into actionable IOCs through controlled, policy-driven AI engagement. Multi-agent LLM architecture with adaptive strategy selection. Primary language: PHP. 21 stars.
Project links:Open GitHub projectBack to radar
<p align="center"> <img src="frontend-react/public/scambuster_logo_horizontal.svg" alt="ScamBuster" width="500" /> </p>
<p align="center"><strong>Automated Scambaiting Honeypot & Threat Intelligence Platform</strong></p>
   
<p align="center"> <img src="frontend-react/public/scambuster_screenshots.gif" alt="ScamBuster Operations Dashboard" width="100%" /> </p>
Most security programs block and forget: the mail goes, the attacker's infrastructure and money rails stay unobserved. ScamBuster engages instead, inbound-only and under policy, turning the exchange into IOCs, actor profiles and tagged tactics (why).
ScamBuster was presented at Black Hat USA 2026 in the Human Factor track.
Hosted demo -- demo.scambuster.ai, login user@example.com / Un1que$trongPassword2024.
Local demo -- make demo-up, then http://localhost:3002: no API key, no account, no mailbox (guide).
| Agent | Role | |-------|------| | ScamClassifier | Categorizes the scam (13 types), detects language | | IocExtractor | Extracts 36 IOC types with context | | Generator | Writes the persona-driven reply | | Validator | Safety and quality gate (PolicyGuard + LLM) | | ConversationDirector | Reads the thread, steers each turn | | Orchestrator | Runs the pipeline, tracks cost and traces | | InjectionDetector | Two-layer prompt injection analysis | | TtpExtractor | Tags scammer tactics, closed taxonomy |
Persona choice is adaptive: epsilon-greedy with UCB1 learns which persona yields most per scam type.
Multilingual by design: detection rules and persona prompts carry non-English content on purpose, so it answers scammers in their own language (details).
Standards, not per-vendor connectors. Verified end to end against OpenCTI (what lands where); the other three follow the same standards, untested live.
Each conversation produces a threat-actor:
{
"type": "threat-actor",
"name": "ScamBuster Actor - INVESTMENT #02114290",
"sophistication": "minimal",
"goals": ["financial-theft"],
"primary_motivation": "personal-gain",
"threat_actor_types": ["criminal"],
"description": "Criminal actor operating investment scam."
}Actors carry ATT&CK mapping, indicates relationships to every IOC, and a psychological profile (profiling, TTPs, API).
git clone https://github.com/laugiov/scambuster.git
cd scambuster
cp .env.dist .env # edit it first, see below
make quickstart # build, start, migrate, seed, JWT keys, n8nFill these 4 in .env before real use:
| Variable | What to do | |----------|------------| | LLM_API_KEY | OpenAI key (or LLM_PROVIDER=mock, no key) | | HONEYPOT_IMAP_USER | Honeypot mailbox (IMAP, receives scams) | | HONEYPOT_IMAP_PASSWORD | App password, not the account password | | MAILER_DSN | SMTP for replies, @ written as %40 |
Left as placeholders, it boots in demo mode and says so. Quickstart · demo · AI install · production · architecture · roadmap · all docs.
ScamBuster is a defensive research tool, not an offensive weapon.
Responsible use is the operator's responsibility. Confirm your deployment is legal where you operate, keep it inbound-only, and never use it to initiate contact, target individuals, harass, or dox. Read the [Disclaimer & Responsible Use](DISCLAIMER.md) before deploying.
More: Security & Guardrails, SECURITY.md.
Code MIT; docs and dataset CC BY-NC-SA 4.0.
See CONTRIBUTING.md, Discussions and Issues.
Laurent Giovannoni -- scambuster.ai · LinkedIn · SECURITY.md.