See risk earlier. Act with context. · threathunter.com
We build products and publish research on business fraud: promotion abuse, bonus farming, bulk sign-ups, scraping, and automated cheating. What we learn in that fight, we turn into open source you can inspect.
Nebula 2.0 — business risk engine
Four-layer domain model (event, feature, policy, watchlist). Flink for real-time scoring. 170 built-in policy templates.
It inherits the risk model from Nebula 1.x and rewrites the stack.
| What it does | Ingests business events, scores them against policies in real time, and emits explainable alerts and lists |
| Vs 1.x | Same domain model, new code. 1.x depends on Python 2, OpenResty 1.11, Esper 6, and other EOL stacks |
| Why it is worth reading | Collector-side redaction, HMAC at rest, and data-subject request hooks — a risk engine holds personal data, so these are not optional extras |
gesture-fingerprint — touch attribution
From mobile touch telemetry, decide whether a tap or swipe came from a person, a software bot, or a specific cheating device.
Not just bot vs human — it names which kind of machine. Nine behavioral dimensions, built from 75k labeled gestures and 8 cheating devices bought off the shelf.
These projects stopped in 2019. Their dependencies are EOL. Do not run them in production. We keep them because they are still useful to read, and because other people already cite them.
| Project | Notes |
|---|---|
| nebula (1098★) | Nebula 1.x — current tree is nebula2 |
| nebula_doc (73★) | 1.x docs |
| sniffer (20★) | 1.x traffic collector |
Rules we hold ourselves to, so you can check:
- Do not mark a plan as done. Every ✅ in the docs is something a reader can verify. Unfinished work is 🚧.
- Say what we did not do. Each project has a section on unmitigated or untested cases — stating an untested claim as a result is worse than omitting it.
- Numbers come from measurement. Capacity, throughput, and resource use name the environment and the method. No estimates dressed as facts.
- Site: threathunter.com
- Do not report security issues in public tickets. Each repo's
SECURITY.mdhas the process; you can also use GitHub private vulnerability reporting.