Rail Networks in the Open: Six OSINT Tools, and What They Show for Malaysia

This is the first post in OSINT, a new part of our Cyber Security section. Open-source intelligence means answering questions from information anyone can lawfully see: maps, timetables, registers, satellite images and published datasets. Here we will look at what public data reveals, the tools analysts use to read it, and how to use them responsibly. We describe risks rather than recipes, and we do not name or profile private people.

We start with railways. On 27 August 2026, Hackers-Arise published a walkthrough by its contributor aircorridor of six free tools for studying a country's rail network, from a map of the track to the live position of a single train (aircorridor, 2026).

The argument is simple. Railways publish a great deal on purpose, because passengers, freight customers and researchers need it, and that openness makes them a rich source on any country's transport infrastructure. Used together, the author concludes, free maps, trackers and directories can rival commercial geospatial analytics.

We checked each tool and ran the same stack over Malaysia. The European trackers see little here, but Malaysia publishes its own live train positions as open data.

Why railways are so readable

A military base hides its layout; a railway prints it on a poster. Timetables, line maps, station plans and delay notices exist so people can catch trains, and the track is a long, fixed structure that is easy to map. The article sorts what this tells an analyst into four layers:

• Topology. Which lines connect where, which stations are junctions and which branches end.

• Capacity. How many trains actually run on a route.

• Physical assets. Stations, depots, marshalling yards and industrial sidings.

• Live movement. Where a given train is now.

Most people who use these layers are commuters, rail fans, planners, researchers and journalists checking whether a promised line was built. Each tool below covers one layer.

Six layers, six tools

1. OpenRailwayMap: the track itself

OpenRailwayMap draws the world's railways from OpenStreetMap, the volunteer-built map, and has been online since 2013. The classic site at openrailwaymap.org offers five map styles: infrastructure (switches, milestones, signal boxes), maximum speeds, signalling and train protection, electrification, and track gauge (OpenStreetMap Wiki, n.d.-a). A newer vector version at openrailwaymap.app adds operator and route views, plus a time slider that shows demolished lines from OpenHistoricalMap (OpenStreetMap Wiki, n.d.-a; Wieringa, n.d.-a). The operator view the article mentions lives there. Both refresh daily.

The catch is that the map is only as detailed as the volunteers who tag the track, so a layer can be rich in one country and nearly empty in the next.

2. NS International station maps: inside the hub

NS International, the international arm of Dutch Railways, publishes floor plans for about 35 major stations in seven countries: the Netherlands, Belgium, France, Germany, Switzerland, Austria and Britain. Most are PDFs meant to help travellers plan a change of trains (NS International, n.d.). The article pairs them with satellite imagery, since a plan shows what a picture from above cannot, such as platform numbers and where exits and connections are.

3. geOps Mobility Portal: Europe in motion

The geOps portal shows trains, trams and buses moving on a map. Positions are calculated from published timetables or, where available, from real-time data, and a coloured ring shows whether a vehicle is on time, late or cancelled (geOps, n.d.-a). The article describes its coverage as most of Europe, with the train number, type of rolling stock and any delay shown for each service.

4. Yandex Rasp train map: Russia and its neighbours

Yandex's timetable service has its own train map, which the article says covers Russia, Belarus, Kazakhstan and Uzbekistan, where geOps does not reach. The page itself notes that train positions are calculated from schedules (Yandex, n.d.), so a dot is an estimate, not a GPS fix.

5. Wikiroutes: the last mile

Wikiroutes is a crowdsourced directory of bus, tram, trolleybus and metro routes in cities around the world. It is not a railway tool, but it shows how passengers get from a station into town, and how rail fits into the rest of a city's transport.

6. City Population: the big numbers

City Population ranks about 135 countries and territories by the total route length of their railways. Its source is a 2020 edition of the CIA World Factbook, and the entries date from 2008 to 2019, more than half of them from 2014 (City Population, n.d.). It is useful for scale, as long as you check the year.

The six tools at a glance

What it shows for Malaysia

We ran the same checks on Malaysia on 19 October 2026.

OpenStreetMap and OpenRailwayMap. A small query through the public Overpass API found 3,448 mainline rail segments in Malaysia. Of these, 2,719 are tagged as metre gauge, the gauge of the KTM network, and 157 as standard gauge. Some 1,920 are tagged as electrified, almost all with 25 kV overhead wires, which is what the electrification layer colours in. But only 29% carry a maximum speed and 7% an operator, so the speed and operator views are patchy here (OpenStreetMap contributors, 2026).

Passenger routes are better mapped. OpenStreetMap has routes for every Rapid KL line (the Ampang, Sri Petaling, Kelana Jaya and Shah Alam LRT lines, the Kajang and Putrajaya MRT lines and the KL Monorail), the KLIA Ekspres and KLIA Transit, KTM Komuter in the Klang Valley and the north, and the ETS. We found no routes for KTM's east-coast intercity trains.

The East Coast Rail Link (ECRL) appears as a railway under construction: 436 standard-gauge segments, including the Kuantan Port spur, and 13 station sites from Kota Bharu to Gombak. Mappers usually keep construction tags until a line opens, and Malaysia Rail Link aims to start commercial service on the Kota Bharu to Gombak section in mid-December 2026 (The Star, 2026), so expect this layer to change soon.

geOps. geOps bills its map as worldwide (geOps, n.d.-a), but its stops service says its data still focuses on Europe (geOps, n.d.-b). Over Kuala Lumpur on a weekday afternoon, the portal showed the rail lines but no vehicles. The same view over Zurich was full of trains.

Wikiroutes. Kuala Lumpur is well covered: 125 city bus routes, the LRT, MRT and monorail lines, the KLIA Aerotrain, and the KTM Komuter and airport rail lines (Wikiroutes, n.d.). George Town, Ipoh, Johor Bahru, Kuantan, Kuching and other cities have pages too.

City Population. Malaysia ranks 77th, with 1,851 km of railway. The figure is dated 2014, so treat it as history.

Malaysia's own open data. This is the strongest layer. The government portal data.gov.my has published GTFS timetables, the standard format behind most journey planners, since November 2023, and live vehicle positions since later that month (Government of Malaysia, n.d.-a). The feeds cover:

• KTMB. The static feed we downloaded lists nine services: the Seremban and Port Klang Komuter lines, the northern Komuter lines, the Shuttle Selatan in Johor, the ETS from Padang Besar to JB Sentral, the Tumpat to Gemas shuttle, the Ekspres Rakyat Timuran and the Shuttle Tebrau to Woodlands (Government of Malaysia, n.d.-d).

• Rapid Rail KL. Eight routes: four LRT lines, two MRT lines, the KL Monorail and the BRT Sunway Line.

• Buses. Rapid KL, MRT feeder, Rapid Penang and Rapid Kuantan buses, and BAS.MY buses in nine cities.

The live feeds give vehicle positions, refreshed every 30 seconds, for KTMB and the buses; a single request on 19 October returned seven KTMB trains. Rapid Rail KL is the gap: its LRT, MRT and monorail feed "does not yet have stable realtime feeds" (Government of Malaysia, n.d.-c). No API key is needed, the limit is four requests a minute per API, and the data is licensed under CC BY 4.0 (Government of Malaysia, n.d.-b, n.d.-e, n.d.-f).

Using it responsibly

Open does not mean anything goes. Transportation is one of the 11 national critical information infrastructure sectors under Malaysia's Cyber Security Act 2024 (National Cyber Security Agency, n.d.). A few rules keep this work useful and safe:

• Stay passive. Read what operators and communities publish. Do not log in to, probe or test railway systems, or enter places you are not allowed into.

• Study infrastructure, not people. Do not use trackers to follow drivers, staff or passengers, or combine train positions with personal details.

• Do not publish weak points. Describing a network is fine; listing where it is most vulnerable is not. Report real security problems privately to the operator.

• Respect terms and rate limits. Keep to data.gov.my's four requests a minute. OpenRailwayMap's vector service bans bulk tile downloads (Wieringa, n.d.-b), and the free Overpass servers are meant for small projects (OpenStreetMap Wiki, n.d.-b). Credit OpenStreetMap and data.gov.my as their licences require.

• Check dates and provenance. Timetable-based dots are estimates, crowdsourced routes go stale, and a 2014 track length is not today's.

The article's conclusion holds: free tools cover much of what a commercial product would. For Malaysia, though, the best layer is not a European tracker but the government's own open data.

References

aircorridor. (2026, August 27). Open source intelligence (OSINT): What open maps and trackers reveal about rail networks. Hackers-Arise. https://hackers-arise.com/open-source-intelligence-osint-what-open-maps-and-trackers-reveal-about-rail-networks/

City Population. (n.d.). Railways: Countries of the world. Retrieved October 19, 2026, from https://www.citypopulation.de/en/world/bymap/railways/

geOps. (n.d.-a). Maps for mobility [Mobility Portal]. Retrieved October 19, 2026, from https://mobility.portal.geops.io/

geOps. (n.d.-b). Stops. geOps Developer Portal. Retrieved October 19, 2026, from https://developer.geops.io/apis/stops

Government of Malaysia. (n.d.-a). Changelog. Malaysia's Official Open API. Retrieved October 19, 2026, from https://developer.data.gov.my/changelog

Government of Malaysia. (n.d.-b). FAQ. Malaysia's Official Open API. Retrieved October 19, 2026, from https://developer.data.gov.my/faq

Government of Malaysia. (n.d.-c). GTFS Realtime. Malaysia's Official Open API. Retrieved October 19, 2026, from https://developer.data.gov.my/realtime-api/gtfs-realtime

Government of Malaysia. (n.d.-d). GTFS Static. Malaysia's Official Open API. Retrieved October 19, 2026, from https://developer.data.gov.my/realtime-api/gtfs-static

Government of Malaysia. (n.d.-e). Quickstart. Malaysia's Official Open API. Retrieved October 19, 2026, from https://developer.data.gov.my/quickstart

Government of Malaysia. (n.d.-f). Rate limit. Malaysia's Official Open API. Retrieved October 19, 2026, from https://developer.data.gov.my/rate-limit

National Cyber Security Agency. (n.d.). National critical information infrastructure (NCII). Retrieved October 19, 2026, from https://nacsa.gov.my/NCII.php

NS International. (n.d.). Station maps for stations in Europe. Retrieved October 19, 2026, from https://www.nsinternational.com/en/stations/station-maps-floor-plan

OpenStreetMap contributors. (2026). OpenStreetMap [Data set, queried through the Overpass API on October 19, 2026]. https://www.openstreetmap.org/

OpenStreetMap Wiki. (n.d.-a). OpenRailwayMap. Retrieved October 19, 2026, from https://wiki.openstreetmap.org/wiki/OpenRailwayMap

OpenStreetMap Wiki. (n.d.-b). Overpass API. Retrieved October 19, 2026, from https://wiki.openstreetmap.org/wiki/Overpass_API

The Star. (2026, October 6). ECRL targets mid-December start for commercial operations. https://www.thestar.com.my/business/business-news/2026/10/06/ecrl-targets-mid-december-start-for-commercial-operations

Wieringa, H. (n.d.-a). OpenRailwayMap vector map styles [Computer software]. GitHub. Retrieved October 19, 2026, from https://github.com/hiddewie/OpenRailwayMap-vector

Wieringa, H. (n.d.-b). Usage policy. OpenRailwayMap vector, GitHub. Retrieved October 19, 2026, from https://github.com/hiddewie/OpenRailwayMap-vector/blob/master/USAGE.md

Wikiroutes. (n.d.). List of Kuala Lumpur public transport routes. Retrieved October 19, 2026, from https://wikiroutes.info/en/kuala-lumpur/catalog

Yandex. (n.d.). Parovoziki [Train map]. Yandex Raspisaniya. Retrieved October 19, 2026, from https://rasp.yandex.ru/map/trains/