01 · Product name
Trace Labs OSINT VM
Trace Labs investigation VM, release tag 2026.10.
Published by Trace Labs.
In short
The Trace Labs OSINT VM is the investigation image maintained by Trace Labs staff in tracelabs/tlosint-vm. On 20 Oct 2026 the GitHub release tag was 2026.10, published by Tayzar02. The README says the recipe builds a Linux OSINT distribution for Trace Labs based on the Kali Linux kali-vm script. A README badge still reads tlosintvm-1.0.0, and the repository page says GPL-3.0 while the badge says GPLv3. The README's default login is osint / osint. This listing does not average the badge and the tag.
Product pricing strategy
02
Free
The release is a GitHub download of a virtual machine. No dollar price, support tier, or paid Trace Labs VM was printed on the repository or the 2026.10 release page opened 20 Oct 2026. The license line on the repository is GPL-3.0, and the README badge says GPLv3. Those are license names, not prices. GitHub's 1.2k star counter is not a fee. The full OVA and the minimal release are both linked from the README as downloads of the 2026.10 release. Do not invent a hosted Trace Labs cloud plan. If the organization sells training elsewhere, that price was not on these pages.
Utility and features
03
The repository https://github.com/tracelabs/tlosint-vm is the product. The release page for tag 2026.10 says Tayzar02 released it, and the notes say a pull request added 18 SOCMINT tools. The same notes point at a Qubes template in tracelabs/qubes-builder-tlosint. The README introduction, visible on the repository page, says the repository includes a recipe to build a Linux OSINT distribution for Trace Labs based on the Kali Linux kali-vm script, and it links the Kali GitLab kali-vm project. The releases section of that README points at the 2026.10 VM release for both a minimal build and a full build that includes pre-installed OSINT tools, with VirtualBox and VMware OVA links.
- Tag 2026.10. The release page showed tag 2026.10, released by Tayzar02, with a note that 18 SOCMINT tools were added.
- Badge 1.0.0. The README badge still reads tlosintvm-1.0.0. The repository sidebar said GPL-3.0 and the badge said GPLv3.
- Kali kali-vm recipe. The README says the build is based on the Kali Linux kali-vm script. The default login it prints is osint / osint.
The raw README also carries a badge that reads tlosintvm-1.0.0 and a GPLv3 badge. The repository sidebar on 20 Oct 2026 said GPL-3.0. The badge version and the release tag are not the same number. Quote the badge and the tag. The README's default login is username osint and password osint. Maintainer notes on the page say the repository is actively maintained by Trace Labs staff. GitHub's own star counter on that view read 1.2k. That is GitHub's counter. A blog post about the release was not opened, so it is not a citation.
- 1
Cite release 2026.10 and badge 1.0.0 as two strings from two places on the project.
- 2
Change osint / osint before the VM is used on a network.
- 3
Keep the README's Kali sentence. Do not swap in a base from a commit title.
Caveats
04
Change the documented login. The README says username osint and password osint. Leaving that account on a shared network publishes the image's default.
Do not merge the badge tlosintvm-1.0.0 with the release tag 2026.10. Do not replace the README's Kali kali-vm sentence with a different base. A commit title on the file list mentioned Debian Trixie ARM64 build support. That is a commit title, not a sentence that the VM's base is Debian, and this listing does not treat it as one. The 18 SOCMINT tools are the release note's count. An OSINT VM collects what the case allows. It is not a reason to ignore the site's terms or to name a private person in a report you cannot source.
Screenshots
05
Potential use cases
06
- The badge and the release tag are about to be averaged. On 20 Oct 2026 the GitHub release was tag 2026.10, released by Tayzar02, and the notes said 18 SOCMINT tools were added. A README badge still reads tlosintvm-1.0.0. The sidebar said GPL-3.0 and the badge said GPLv3. Write the string from the place you mean. GitHub's star counter read 1.2k on that view.
- The README's Kali sentence is about to be replaced. It says the recipe builds a Linux OSINT distribution for Trace Labs based on the Kali Linux kali-vm script. A commit title mentioned Debian Trixie ARM64 support. That title is not a base-distro sentence, and this listing does not treat it as one. The README's default login is osint / osint.
- The VM is about to be briefed as permission to collect. Trace Labs maintains the repository, and the release includes a full build with tools preinstalled. An investigation image does not waive a site's terms or a rule about naming a private person. Change the default account before the VM faces a network.
Hard cases
The case where the first result is easy to over-read.
1.0.0 and 2026.10 become one version
The badge and the release tag disagree. Averaging them, or dropping the badge because the tag looks newer, hides a string the project still publishes. Cite 2026.10 as the release you download and 1.0.0 as the badge that was still on the README.
Questions
What version is the Trace Labs VM?
The GitHub release tag on 20 Oct 2026 was 2026.10. A README badge still said tlosintvm-1.0.0. Both are quoted. They are not averaged.
What is it based on, and what does it cost?
The README says it is based on the Kali Linux kali-vm script. No dollar price was printed. The repository says GPL-3.0, and the badge says GPLv3.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Trace Labs OSINT VM release 2026.10
https://github.com/tracelabs/tlosint-vm/releases/tag/2026.10Documentation
Trace Labs OSINT VM repository
https://github.com/tracelabs/tlosint-vm