@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/techniques/threat-intel.md

@@ -0,0 +1,315 @@
+# Threat Intelligence Module
+
+> **Module ID:** THR-INTEL-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** Educational Threat Intelligence Lookup
+
+---
+
+## 1. Overview
+
+Aggregates threat reputation data for IPs, domains, URLs, and file hashes from free public feeds. Use for triage during incident response, phishing investigation, or infrastructure vetting. Always cross-reference at least two sources before drawing conclusions.
+
+---
+
+## 2. Tool Inventory
+
+| Priority | Tool | Target Types | Free Limit | Register |
+|----------|------|-------------|-----------|---------|
+| Primary | AbuseIPDB | IP | 1000/day | abuseipdb.com/account/api |
+| Primary | VirusTotal | Domain, URL, Hash | 500/day, 4/min | virustotal.com |
+| Primary | MalwareBazaar | Hash | Unlimited | bazaar.abuse.ch |
+| Secondary | GreyNoise Community | IP | 50/week | greynoise.io |
+| Secondary | AlienVault OTX | IP, Domain | Unlimited | otx.alienvault.com |
+| Secondary | URLhaus | URL | Unlimited | None required |
+| Secondary | ThreatFox | Domain, IP, Hash | Unlimited | None required |
+| Secondary | **URLScan.io** | Domain, URL, IP | 100 scans/day free | https://urlscan.io/user/signup |
+| Tertiary | Pulsedive | IP, Domain | Limited | pulsedive.com |
+| Tertiary | HudsonRock Cavalier | Domain | Unlimited | None required |
+| Tertiary | **CIRCL CVE Search** | CVE, Vendor, Product | Unlimited | None required |
+| Tertiary | **NVD API v2** | CVE, Keyword, CPE | 5 req/30s (no key) | https://nvd.nist.gov/developers/request-an-api-key |
+| Tertiary | **Ransomware.live** | Org name, Domain | Unlimited | None required |
+
+---
+
+## 3. Investigation Workflow
+
+**Step 1: Classify input type**
+- IPv4/IPv6 address → IP path
+- Domain name (no path) → Domain path
+- Full URL (with scheme/path) → URL path
+- MD5/SHA1/SHA256 hex string → Hash path
+
+**Step 2: Run primary tools for input type** (parallel where possible)
+
+**Step 3: Aggregate verdicts** — majority vote across sources, weight by source reliability
+
+**Step 4: Escalate if** any source returns `malicious` with confidence ≥ HIGH
+
+**Step 5: Document** findings with timestamps and source links
+
+---
+
+## 4. CLI Commands & Expected Output
+
+**IP — AbuseIPDB:**
+```bash
+curl -sG "https://api.abuseipdb.com/api/v2/check" \
+  -d "ipAddress=<IP>" -d "maxAgeInDays=90" \
+  -H "Key: <YOUR_KEY>" -H "Accept: application/json" | jq .data
+# Returns: abuseConfidenceScore (0-100), totalReports, countryCode, isp
+```
+
+**IP — GreyNoise Community:**
+```bash
+curl -s "https://api.greynoise.io/v3/community/<IP>" \
+  -H "key: <YOUR_KEY>" | jq .
+# Returns: noise (bool), riot (bool), classification, name, link
+```
+
+**IP — AlienVault OTX:**
+```bash
+curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/<IP>/general" | jq .pulse_info.count
+# Returns: pulse count (threat intel hits), reputation score
+```
+
+**Domain — VirusTotal:**
+```bash
+curl -s "https://www.virustotal.com/api/v3/domains/<domain>" \
+  -H "x-apikey: <YOUR_KEY>" | jq '.data.attributes.last_analysis_stats'
+# Returns: {malicious: N, suspicious: N, harmless: N, undetected: N}
+```
+
+**URL — URLhaus:**
+```bash
+curl -s -d "url=<URL>" "https://urlhaus-api.abuse.ch/v1/url/" | jq '{query_status, threat, tags}'
+# Returns: query_status (is_listed/not_listed), threat type, tags
+```
+
+**Domain — ThreatFox:**
+```bash
+curl -s -d '{"query":"search_ioc","search_term":"<domain>"}' \
+  "https://threatfox-api.abuse.ch/api/v1/" | jq '.data[0] | {ioc_type, malware, confidence_level}'
+```
+
+**Hash — MalwareBazaar:**
+```bash
+curl -s -d "query=get_info&hash=<sha256>" "https://mb-api.abuse.ch/api/v1/" | \
+  jq '.data[0] | {file_name, file_type, tags, vendor_intel}'
+# Returns: file metadata, AV detections, malware family tags
+```
+
+**Domain — HudsonRock (stealer log exposure):**
+```bash
+curl -s "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=<domain>"
+# Returns: employee/user credential exposures from infostealer logs
+```
+
+**Domain/URL — URLScan.io (search existing scans):**
+```bash
+# Search for existing scans of a domain (no auth needed for search):
+curl -s "https://urlscan.io/api/v1/search/?q=domain:<domain>" | jq '.results[] | {url: .page.url, ip: .page.ip, country: .page.country, server: .page.server, title: .page.title}'
+# Returns: matching scan results with page metadata, IPs, technologies
+
+# Submit a new scan (requires free API key):
+curl -s -X POST "https://urlscan.io/api/v1/scan/" \
+  -H "API-Key: <YOUR_KEY>" -H "Content-Type: application/json" \
+  -d '{"url": "https://<domain>", "visibility": "public"}'
+# Returns: {uuid, api_url, result_url} — poll result_url after ~30s
+
+# Retrieve scan result:
+curl -s "https://urlscan.io/api/v1/result/<uuid>/" | jq '{page: .page, lists: .lists, stats: .stats}'
+# Returns: screenshot URL, DOM content, network requests, certificates, cookies, linked domains
+```
+
+**CVE — CIRCL CVE Search (free, no auth):**
+```bash
+# Lookup specific CVE:
+curl -s "https://cve.circl.lu/api/cve/<CVE-ID>" | jq '{id: .id, summary: .summary, cvss: .cvss, references: .references}'
+# Returns: CVE details, CVSS score, references, affected products
+
+# Search by vendor/product:
+curl -s "https://cve.circl.lu/api/search/<vendor>/<product>" | jq '.[0:5] | .[] | {id: .id, summary: .summary, cvss: .cvss}'
+# Returns: list of CVEs affecting that vendor's product
+
+# Last 30 CVEs published:
+curl -s "https://cve.circl.lu/api/last" | jq '.[0:10] | .[] | {id: .id, summary: .summary}'
+```
+
+**CVE — NVD API v2 (NIST, rate-limited):**
+```bash
+# Search by keyword:
+curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=<keyword>&resultsPerPage=5" \
+  | jq '.vulnerabilities[].cve | {id: .id, description: .descriptions[0].value, severity: .metrics.cvssMetricV31[0].cvssData.baseSeverity}'
+# Rate: 5 req/30s without key, 50 req/30s with key
+
+# Lookup specific CVE:
+curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=<CVE-ID>" \
+  | jq '.vulnerabilities[0].cve | {id: .id, published: .published, description: .descriptions[0].value}'
+
+# Search by CPE (product identifier):
+curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cpeName=cpe:2.3:a:<vendor>:<product>:*:*:*:*:*:*:*:*" \
+  | jq '.vulnerabilities[].cve | {id: .id, severity: .metrics.cvssMetricV31[0].cvssData.baseSeverity}'
+```
+
+**Org — Ransomware.live (ransomware victim/group tracking):**
+```bash
+# Search for an organization by keyword:
+curl -s "https://api.ransomware.live/v2/searchvictims/<org_name>" | jq '.[0:5] | .[] | {victim: .victim, group: .group_name, date: .discovered, country: .country}'
+# Returns: victim name, ransomware group, discovery date, country
+
+# Recent victims:
+curl -s "https://api.ransomware.live/v2/recentvictims" | jq '.[0:10] | .[] | {victim: .victim, group: .group_name, date: .discovered}'
+
+# Victims by country (ISO-2 code):
+curl -s "https://api.ransomware.live/v2/countryvictims/<CC>" | jq '.[0:10] | .[] | {victim: .victim, group: .group_name}'
+
+# Victims by sector:
+curl -s "https://api.ransomware.live/v2/sectorvictims/<sector>" | jq '.[0:5] | .[] | {victim: .victim, group: .group_name}'
+
+# List all ransomware groups:
+curl -s "https://api.ransomware.live/v2/groups" | jq '.[0:10] | .[] | {name: .name}'
+
+# Specific group details + their victims:
+curl -s "https://api.ransomware.live/v2/group/<group_name>" | jq '{name: .name}'
+curl -s "https://api.ransomware.live/v2/groupvictims/<group_name>" | jq '.[0:5] | .[] | {victim: .victim, date: .discovered}'
+```
+
+---
+
+## 5. Fallback Cascade
+
+| Primary Unavailable | Use Instead |
+|--------------------|-------------|
+| AbuseIPDB (quota) | OTX + GreyNoise manual via web UI |
+| VirusTotal (quota) | ThreatFox + URLhaus for domains/URLs |
+| MalwareBazaar | VirusTotal hash endpoint |
+| GreyNoise (quota) | Shodan web search (no key needed for basic) |
+| All APIs down | Manual web UI search on any primary tool |
+
+---
+
+## 6. Output Interpretation
+
+**AbuseIPDB score:**
+- 0–24: Clean/low noise
+- 25–74: Suspicious, investigate further
+- 75–100: Malicious, block/alert
+
+**GreyNoise classification:**
+- `riot: true` = Known benign internet scanner (CDN, security vendor) — likely FP
+- `noise: true, classification: malicious` = Active threat actor
+- `noise: false` = Not observed scanning internet — could be targeted
+
+**VirusTotal stats:**
+- `malicious ≥ 3` vendors: Confirmed threat
+- `malicious 1–2`: Investigate; check which vendors flagged
+- `suspicious > 0, malicious 0`: Borderline; context required
+
+**Verdict aggregation (majority vote):**
+```
+weight: VirusTotal=3, AbuseIPDB=3, MalwareBazaar=3, OTX=2, ThreatFox=2, URLhaus=2, GreyNoise=1
+MALICIOUS  → weighted_malicious > weighted_clean
+SUSPICIOUS → tie or single-source flag
+CLEAN      → all sources return benign/not listed
+```
+
+---
+
+## 7. Confidence Ratings
+
+| Finding Type | Confidence | Notes |
+|-------------|-----------|-------|
+| Hash malware match | HIGH | Cryptographic match, no ambiguity |
+| IP abuse score ≥ 75 | HIGH | Multi-reporter consensus |
+| URL listed in URLhaus | HIGH | Active/recent listing |
+| Domain VirusTotal ≥ 5 vendors | HIGH | Strong consensus |
+| Single-source flag only | LOW | Possible false positive |
+| GreyNoise noise=true only | MEDIUM | Known scanner, not targeted threat |
+| OTX pulse count only | LOW | Community-submitted, unverified |
+
+---
+
+## 8. Limitations
+
+- **Rate limits** — Free tiers exhaust quickly on bulk investigations; cache results locally
+- **VirusTotal**: 4 req/min hard limit; bursting causes 429 errors
+- **GreyNoise Community**: 50 lookups/week — reserve for high-priority IPs only
+- **False positives**: CDNs, shared hosting IPs frequently flagged; validate with GreyNoise RIOT
+- **False negatives**: Brand-new C2 infrastructure won't appear in any feed for 24–72 hours
+- **HudsonRock**: Dataset coverage varies; absence of results does not mean clean
+- **Hash matching**: Only exact matches; recompiled/packed variants evade hash lookups
+- **URLhaus**: Focuses on malware distribution URLs; phishing-only URLs may not appear
+
+---
+
+## 9. Command Reference
+
+| Command | Purpose | Input |
+|---------|---------|-------|
+| `/threat-check <IP>` | Full IP reputation lookup | IPv4 or IPv6 address |
+| `/threat-check <domain>` | Domain threat intel | Domain name |
+| `/threat-check <url>` | URL threat lookup | Full URL with scheme |
+| `/threat-check <hash>` | Malware hash lookup | MD5, SHA1, or SHA256 |
+| `/vuln-check <query>` | CVE/vulnerability lookup | CVE ID, vendor, product, or keyword |
+| `/ransomware-check <org>` | Ransomware victim lookup | Organization name or domain |
+
+---
+
+## 10. Vulnerability Lookup (`/vuln-check`)
+
+Queries CIRCL CVE Search and NVD API v2 to surface known vulnerabilities for a product, vendor, or specific CVE ID. Use during org exposure assessment or infrastructure vetting.
+
+**Input classification:**
+- `CVE-YYYY-NNNNN` → direct CVE lookup on both CIRCL and NVD
+- `vendor/product` (e.g., `apache/httpd`) → search by vendor+product on CIRCL
+- Free text keyword → keyword search on NVD API v2
+
+**Workflow:**
+1. Classify input type
+2. Query CIRCL CVE Search first (no auth, no rate limit)
+3. Cross-reference with NVD API v2 for CVSS scores and severity
+4. Aggregate results, sort by CVSS score descending
+5. Flag CRITICAL/HIGH severity CVEs prominently
+
+**Confidence:** HIGH for exact CVE match; MEDIUM for keyword/product search (may return false positives).
+
+---
+
+## 11. Ransomware Victim Check (`/ransomware-check`)
+
+Queries ransomware.live API to determine if an organization has appeared on ransomware group leak sites. Critical for due diligence and incident awareness.
+
+**Input:** Organization name or domain
+**Workflow:**
+1. Query `https://api.ransomware.live/v2/searchvictims/<org_name>` for direct keyword search
+2. If match found: extract group name, discovery date, country, and activity status
+3. Query `https://api.ransomware.live/v2/groupvictims/<group_name>` for group victim list
+4. Cross-reference with recent victims endpoint for recency context
+5. Document findings with direct links to ransomware.live
+
+**Confidence:** HIGH if exact victim match; MEDIUM for partial name match (may catch unrelated orgs with similar names).
+
+**Output fields:** victim name, ransomware group, discovery date, country, activity status, group profile URL.
+
+---
+
+## 12. URLScan.io Integration
+
+URLScan.io provides passive domain/URL intelligence by searching existing scan results, or active scanning with a free API key.
+
+**OSINT use cases:**
+- Domain infrastructure mapping (IPs, ASNs, technologies, certificates)
+- Phishing page detection (screenshot + DOM analysis)
+- Related domain discovery (shared IPs, tracking codes)
+- Historical scan data for timeline construction
+
+**Free tier:** 100 private scans/day, 5000 results/day search, unlimited public scan viewing.
+**Registration:** https://urlscan.io/user/signup
+
+---
+
+*Threat Intelligence Module v1.1.0 — Updated 2026-03-30*
+*Part of Free OSINT Expert Skill - Phase 5*
+*For authorized security research and incident response purposes only*

package/skills/cti-expert/techniques/transport-tracking.md

@@ -0,0 +1,353 @@
+# Transport Tracking Module
+
+> **Module ID:** TRANS-TRACK-001
+> **Version:** 1.0.0
+> **Phase:** 5 - Enhancement Modules
+> **Classification:** Flight, Maritime & Vehicle Tracking Intelligence
+
+---
+
+## 1. Overview
+
+Transport tracking OSINT extracts real-time and historical movement intelligence from aircraft, vessels, and vehicles. Use when a target entity (person, organization, or asset) is linked to a registration number, callsign, tail number, MMSI, IMO, or VIN and you need to establish location patterns, ownership, or logistics.
+
+**Key use cases:** Geopolitical analysis, sanctions enforcement, corporate intelligence, military activity monitoring, export control violations, private equity due diligence, and journalist investigations.
+
+---
+
+## 2. Tool Inventory
+
+### Aviation
+
+#### ADS-B Exchange
+**URL:** https://globe.adsbexchange.com/
+
+The gold standard for unfiltered aircraft tracking. Unlike FlightRadar24, ADS-B Exchange does **not** censor military, government, or sensitive operator aircraft — it shows everything the community-fed ADS-B receiver network picks up.
+
+- **Key differentiator:** Displays military, law enforcement, and "blocked" aircraft that commercial trackers suppress
+- **Usage:** Search by callsign, tail/registration number (N-number for US), or ICAO 24-bit hex code. Pan and zoom map for area-based monitoring.
+- **Data source:** Community-fed ADS-B ground receivers; no filtering contracts
+
+#### Flightradar24
+**URL:** https://www.flightradar24.com/
+
+Most widely used live flight tracker. Excellent UI, broad global ADS-B and MLAT coverage, and rich historical playback. Censors some military and government flights by agreement.
+
+- **Usage:** Click aircraft on map or search by flight number, registration, or route
+- **Strength:** Best for commercial aviation, charter flights, and general aviation
+
+#### Icarus.flights
+**URL:** https://icarus.flights/
+
+Uncensored aircraft activity analysis and global tracking with pattern-of-life analysis focus.
+
+- **Usage:** Search and analyze aircraft movement patterns, frequent routes, and operator behavior
+
+#### FlightAware
+**URL:** https://flightaware.com/
+
+Flight tracking with route history, delay data, and gate information. Strong on US domestic coverage.
+
+- **Usage:** Search by flight number, tail number, or city-pair route
+
+#### LiveATC
+**URL:** https://www.liveatc.net/
+
+Live air traffic control audio feeds from airports worldwide. No account required.
+
+- **Usage:** Select airport → listen to live ATC communications. Useful for confirming specific aircraft activity at a location by monitoring for callsign mentions.
+
+### Maritime
+
+#### Marine Traffic
+**URL:** https://www.marinetraffic.com/
+
+Primary live vessel tracking via AIS (Automatic Identification System) data. Shows ship positions, routes, port call history, and vessel particulars.
+
+- **Usage:** Search by vessel name, MMSI number, or IMO number. Browse map for port activity. Filter by vessel type (tanker, container, bulk carrier, etc.)
+
+#### VesselFinder
+**URL:** https://www.vesselfinder.com/
+
+Free AIS ship tracker providing vessel positions, port arrivals/departures, and voyage data. Useful as a second source when Marine Traffic data appears stale.
+
+- **Usage:** Search vessel or browse map. Displays current speed, heading, and declared destination port.
+
+### Vehicle
+
+#### VIN Decoder (VINDecoderZ)
+**URL:** http://www.vindecoderz.com/
+
+Decodes 17-character Vehicle Identification Numbers. Returns make, model, year, engine type, transmission, and manufacturing plant.
+
+- **Usage:** Enter 17-character VIN → full vehicle specification decode
+
+#### VINCheck — NICB
+**URL:** https://www.nicb.org/vincheck
+
+Official National Insurance Crime Bureau theft and salvage database. No account required. Up to 5 free searches per day.
+
+- **Usage:** Enter VIN → check if the vehicle has been reported stolen or declared salvage-titled
+
+#### FAXVIN
+**URL:** https://www.faxvin.com/
+
+Free vehicle history reports. Returns accident records, title history, odometer readings, and reported damage.
+
+- **Usage:** Enter VIN → retrieve available history data. Useful for confirming vehicle provenance.
+
+---
+
+## 3. Investigation Workflow
+
+```
+Aircraft Investigation:
+Step 1: Identify aircraft identifier
+  └─ Tail/registration number (e.g., N12345 for US, G-ABCD for UK)
+  └─ ICAO 24-bit hex code (persistent across callsign changes)
+  └─ Callsign (flight-specific; changes per mission/flight)
+
+Step 2: Live position and recent activity
+  └─ ADS-B Exchange → military, government, "blocked" aircraft (unfiltered)
+  └─ Flightradar24 → commercial and general aviation (better UI)
+
+Step 3: Historical movement analysis
+  └─ Flightradar24 Playback mode for past 12 months of flight tracks
+  └─ ADS-B Exchange historical data for unfiltered records
+  └─ Note: ICAO hex code is persistent — use it when callsign is unknown
+
+Step 4: ATC audio monitoring (optional, confirmatory)
+  └─ LiveATC → select departure or arrival airport
+  └─ Monitor for callsign mentions to confirm specific activity
+
+Step 5: Ownership registry lookup
+  └─ FAA N-number registry (US): https://registry.faa.gov/AircraftInquiry/
+  └─ Returns registered owner, operator, address, certification status
+  └─ Non-US: search "{country} aircraft registry" for national authority
+
+Maritime Investigation:
+Step 1: Identify vessel
+  └─ Vessel name (may change — prefer IMO number)
+  └─ MMSI: 9-digit maritime mobile service identity
+  └─ IMO: 7-digit International Maritime Organization number (permanent)
+
+Step 2: Live position and voyage data
+  └─ Marine Traffic → AIS position, heading, speed, declared destination
+  └─ VesselFinder → secondary confirmation; compare AIS timestamps
+
+Step 3: Port call history and route patterns
+  └─ Marine Traffic historical voyages → identify regular routes, unusual stops
+  └─ Long AIS gaps (dark periods) are a key intelligence signal
+
+Step 4: Flag state and ownership lookup
+  └─ Marine Traffic vessel details → flag state, registered owner, manager
+  └─ Cross-reference flag state with sanctions risk (Panama, Palau, Comoros = elevated)
+
+Step 5: Sanctions screening
+  └─ OFAC SDN list: https://sanctionssearch.ofac.treas.gov/
+  └─ Search vessel name, IMO, and registered owner/operator names
+
+Vehicle Investigation:
+Step 1: Decode VIN for vehicle specification
+  └─ VINDecoderZ → make, model, year, engine, plant of manufacture
+
+Step 2: Theft and salvage status
+  └─ NICB VINCheck → confirms if reported stolen or salvage-titled
+
+Step 3: History and provenance
+  └─ FAXVIN → accident history, title transfers, odometer readings
+
+Step 4: Cross-reference with owner identity
+  └─ State DMV records (varies by jurisdiction; many accessible via third-party aggregators)
+  └─ License plate → VIN → owner chain in commercial data brokers
+```
+
+---
+
+## 4. CLI Commands & Expected Output
+
+### FAA N-Number Registry Lookup (US Aircraft)
+```bash
+# Retrieve FAA registration data for US aircraft
+# Replace N12345 with target tail number
+curl -s "https://registry.faa.gov/AircraftInquiry/Search/NNumberInquiry?nNumber=N12345" \
+  | grep -oP '(?<=<td>)[^<]+' | head -30
+```
+
+### ADS-B Exchange API (Historical Track)
+```bash
+# Get recent track data for aircraft by ICAO hex code
+# Replace ABCDEF with target ICAO hex
+curl -s "https://globe.adsbexchange.com/re-api/?find=ABCDEF" \
+  | python3 -m json.tool
+```
+
+**Expected output (abbreviated):**
+```json
+{
+  "icao": "ABCDEF",
+  "r": "N12345",
+  "t": "B738",
+  "lat": 40.6413,
+  "lon": -73.7781,
+  "alt_baro": 35000,
+  "gs": 465,
+  "track": 270,
+  "flight": "UAL123"
+}
+```
+
+### Marine Traffic Vessel Search (Web)
+```bash
+# No CLI — use browser or WebFetch
+# URL pattern for vessel by MMSI:
+# https://www.marinetraffic.com/en/ais/details/ships/mmsi:{MMSI}
+
+# URL pattern for vessel by IMO:
+# https://www.marinetraffic.com/en/ais/details/ships/imo:{IMO}
+```
+
+### NICB VINCheck (Web)
+```bash
+# Browser only — no API
+# URL: https://www.nicb.org/vincheck
+# Input: 17-character VIN
+# Returns: "No theft/salvage record found" or "Record found" with type
+```
+
+### VIN Position Reference
+```bash
+# VIN structure decode (no tool needed):
+# Position 1-3: World Manufacturer Identifier (WMI)
+#   1HG = Honda USA, JT2 = Toyota Japan, WBA = BMW Germany
+# Position 4-8: Vehicle Descriptor Section (model, body, engine)
+# Position 9: Check digit
+# Position 10: Model year
+#   A=1980, B=1981 ... Y=2000, 1=2001 ... 9=2009, A=2010 (cycles)
+# Position 11: Plant of manufacture
+# Positions 12-17: Sequential production number
+
+python3 -c "
+vin = 'JH4DA3340HS000001'
+model_year_map = {
+    'A':'1980','B':'1981','C':'1982','D':'1983','E':'1984','F':'1985',
+    'G':'1986','H':'1987','J':'1988','K':'1989','L':'1990','M':'1991',
+    'N':'1992','P':'1993','R':'1994','S':'1995','T':'1996','V':'1997',
+    'W':'1998','X':'1999','Y':'2000','1':'2001','2':'2002','3':'2003',
+    '4':'2004','5':'2005','6':'2006','7':'2007','8':'2008','9':'2009',
+    'A':'2010','B':'2011','C':'2012','D':'2013','E':'2014','F':'2015',
+    'G':'2016','H':'2017','J':'2018','K':'2019','L':'2020','M':'2021',
+    'N':'2022','P':'2023','R':'2024','S':'2025'
+}
+print(f'WMI: {vin[0:3]}')
+print(f'Model Year Code: {vin[9]} → {model_year_map.get(vin[9], \"unknown\")}')
+print(f'Plant: {vin[10]}')
+print(f'Sequence: {vin[11:]}')
+"
+```
+
+---
+
+## 5. Analysis & Interpretation Guidance
+
+### Aviation Intelligence Signals
+
+```
+ICAO hex code significance:
+  - Persistent identifier — does NOT change when callsign changes
+  - Military aircraft often use hex codes with specific country prefixes
+  - US military: AE0000–AFFFFF range
+  - Use hex code as the stable pivot identifier across all queries
+
+Callsign interpretation:
+  - Commercial airlines: IATA code + flight number (e.g., UAL123 = United 123)
+  - Military: unit designators (e.g., REACH = USAF air mobility)
+  - Government: agency codes (e.g., EXEC1F = Air Force One)
+  - "BLOCKED" or no callsign: operator requested filter (visible on ADS-B Exchange)
+
+Altitude and speed anomalies:
+  - Aircraft holding at low altitude near a border = surveillance pattern
+  - High-speed, high-altitude, no callsign = likely military
+  - Repeated figure-8 patterns = ISR (intelligence/surveillance/reconnaissance)
+```
+
+### Maritime Intelligence Signals
+
+```
+AIS dark periods:
+  - Vessels legally required to broadcast AIS; disabling it is a red flag
+  - Common for: sanctions evasion, illegal fishing, smuggling operations
+  - Check: did vessel reappear in different location inconsistent with last position?
+
+Flag state risk scoring (informal):
+  LOW RISK:  Norway, Marshall Islands, Bahamas (major maritime registries)
+  MEDIUM:    Panama, Liberia (common legitimate flags of convenience)
+  HIGH:      Comoros, Palau, Tuvalu, Belize (frequently used for sanctions evasion)
+  CRITICAL:  Russia, Iran, North Korea flagged vessels
+
+Ship name changes:
+  - Use IMO number (permanent) to track vessels across name and flag changes
+  - Sanctioned vessels frequently rename after each exposure
+  - Marine Traffic shows full name history under "History" tab
+
+STS (ship-to-ship) transfer indicators:
+  - Two vessels in close proximity in open ocean (not a port)
+  - Both vessels showing same GPS coordinates = AIS spoofing
+  - Common in: Iranian oil transfers, Russian grain diversions
+```
+
+### Vehicle Intelligence Signals
+
+```
+VIN tampering indicators:
+  - VIN check digit (position 9) fails mathematical validation = likely altered
+  - Mismatched WMI and country of sale
+  - Sequential number range anomaly for declared year
+
+Cross-border vehicle trafficking:
+  - VIN in US database with foreign plate photos
+  - Salvage title in one state, clean title in another (title washing)
+  - FAXVIN odometer rollback: reported mileage decreases over time
+```
+
+### Confidence Ratings
+
+| Finding Type | Confidence | Notes |
+|---|---|---|
+| Aircraft live position (ADS-B) | HIGH | Real-time receiver data |
+| Aircraft ICAO hex identity | HIGH | Hardcoded in transponder |
+| Aircraft registered owner (FAA) | HIGH | Official registry |
+| Vessel live AIS position | MEDIUM | Can be spoofed or disabled |
+| Vessel IMO identity | HIGH | Permanent identifier |
+| Vessel beneficial owner | LOW | Often obscured via flags/shells |
+| VIN vehicle specification | HIGH | Manufacturer-encoded |
+| VIN theft/salvage status | HIGH | NICB official database |
+| VIN registered owner | LOW-MEDIUM | Varies by jurisdiction |
+
+---
+
+## 6. Limitations
+
+1. **ADS-B blind spots** — Aircraft flying at low altitude, in remote areas, or with transponder off produce no ADS-B signal
+2. **AIS spoofing** — GPS coordinates in AIS broadcasts can be falsified; cross-check with satellite AIS (S-AIS) when available
+3. **Vessel name changes** — Always anchor lookups on IMO (permanent), not vessel name
+4. **VIN jurisdictions** — Non-US vehicles may use different identifier standards; this module is VIN/US-centric
+5. **NICB VINCheck** — Limited to US-reported theft and salvage records; does not cover international databases
+6. **FlightRadar24 censorship** — Some military and government operators pay to have their aircraft filtered; use ADS-B Exchange for complete picture
+7. **Historical data depth** — Free tiers on all platforms limit historical track access; deep history requires paid subscriptions
+
+---
+
+## 7. Command Reference
+
+| Command | Purpose | Input |
+|---|---|---|
+| `/track-aircraft [identifier]` | Track aircraft by tail, hex, or callsign | N-number, ICAO hex, or callsign |
+| `/track-vessel [identifier]` | Track vessel by name, MMSI, or IMO | Vessel name, MMSI, or IMO number |
+| `/decode-vin [vin]` | Decode VIN and check theft/salvage | 17-character VIN |
+
+---
+
+*Transport Tracking Module v1.0.0*
+*Part of Free OSINT Expert Skill - Phase 5*
+*For authorized investigation and educational purposes only*