---

name: offensive-osint description: "Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map."

Offensive OSINT Methodology

Workflow

1. Define target scope (domain, org, person, crypto address, or geo subject)
2. Select applicable categories below based on scope
3. Work top-down within each category; pivot on discovered artifacts
4. Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256)
5. Log findings in JSONL with a run_id and tool versions for reproducibility
6. Suggest next steps based on what each tool returns

---

General OSINT

• Bookmarks — Comprehensive OSINT bookmarks
• OSINT Framework — Tool/resource directory
• IntelTechniques Tools — Suite of investigative tools
• Bellingcat Toolkit — Investigative journalism tools
• CyberSudo OSINT Toolkit — OSINT websites list
• Google Dorks — Efficient Google searching
• Distributed Denial of Secrets — Leaked data
• Country-Specific Resources — Country-targeted OSINT

Search Engines

| Tool | Notes | |------|-------| | Carrot2 | Clusters results by topic | | etools | Metasearch engine | | Kagi | Privacy-first, non-personalized results | | Brave Search | Independent index; Goggles for custom ranking | | PDF Search | Search PDF files and view table of contents | | Google Fact Check Explorer | Cross-site fact-check search |

---

Username & Email Investigation

| Tool | Purpose | |------|---------| | Sherlock | Username search across social networks | | Maigret | Collect profiles by username from many sites | | What's My Name | Username search across platforms | | Holehe | Check if email is registered on platforms | | Epieos | Email address pivots and metadata | | OSINT Industries | Email/username/phone lookups | | Hunter.io | Find email addresses for a domain | | EmailRep | Email reputation and associated data | | Emailable | Verify email existence | | Mugetsu | X/Twitter username history | | RocketReach / Apollo | Email enrichment and pattern guessing | | PhoneInfoga | Phone number intelligence framework |

Browser extensions: GetProspect, SignalHire

---

People Search

• TruePeopleSearch — Free U.S. people search
• WhitePages — Contact information
• Spokeo — People search engine
• Webmii — People search
• Pipl — Deep web people search (paid)
• Clearbit — Company/individual data enrichment
• FaceCheck / FaceSeek — Reverse face search

---

Phone Number OSINT

• TrueCaller — Caller ID and spam blocking
• ThatsThem — Reverse phone search
• Infobel — Phone search outside USA
• FreeCarrierLookup — Carrier/type lookup (US)
• NumlookupAPI [Freemium] — Programmatic carrier/line-type checks
• CallerIDTest — Phone search
• Advanced Background Checks — All people linked to a number

---

Social Media

| Platform | Tool | |----------|------| | Instagram | Picuki — view profiles without account | | X/Twitter | snscrape — preferred CLI scraper; use Twint only as fallback | | Facebook | Graph Search, sowsearch.info, lookup-id.com, whopostedwhat.com | | Facebook (research) | Meta Content Library — CrowdTangle successor (researcher-gated) | | YouTube/Twitch | Social Blade — analytics | | TikTok | Tokboard — trend and profile analytics | | Reddit | Reveddit — removed content; RedTrack.social — user history | | Bluesky | Firesky — real-time firehose; SkyView — follower graphs | | Mastodon | FediSearch — cross-instance search; Fedifinder — find Twitter users on Mastodon | | Faces | Search4Faces |

---

Public Records & Company Information

• OpenCorporates — World's largest open company database
• SEC EDGAR — U.S. company filings
• OpenOwnership Register — Beneficial ownership datasets
• MuckRock — FOIA repository and request tracking
• EU Tenders (TED) — EU procurement notices
• World Bank Projects — Project and procurement records

RU/CN Registries

Russia: Rusprofile, Kontur.Focus (freemium), zakupki.gov.ru (procurement), EGRUL/EGRIP (official, captcha-gated)

China: GSXT (National Enterprise Credit), Qichacha/Tianyancha (freemium), MIIT ICP/Beian (ICP filings)

Sanctions & Compliance

• OFAC SDN List
• EU Sanctions Map
• OpenSanctions — Aggregated persons/entities datasets
• OCCRP Aleph — Investigative documents, leaks, company records

---

Breach & Leak Data

• Have I Been Pwned — Breach lookup; Pwned Passwords API (k-anonymity)
• Dehashed — Credential search
• IntelX — Data intelligence
• LeakCheck — Breach lookups
• Snusbase — Database breach lookups
• BreachDirectory — Recent breach credentials
• Scattered Secrets
• Cavalier (Hudson Rock) — Infostealer lookups
• Phonebook
• LeakPeek

---

Infrastructure & Attack-Surface OSINT

• Shodan — Internet-connected device/service search
• Censys — Host and certificate enumeration
• GreyNoise — Distinguish background noise from targeted scans
• SecurityTrails — Passive DNS and asset discovery
• SpiderFoot — Automated recon and correlation
• theHarvester — Subdomain, email, metadata harvesting
• Recon-ng — Web recon framework
• Amass / Subfinder — Passive subdomain discovery
• BuiltWith — Tech stack enumeration
• Netlas — Large-scale HTTP/DNS/certificate pivots
• BinaryEdge / FOFA / ZoomEye — Infra pivots complementing Shodan/Censys
• RiskIQ PassiveTotal — Passive DNS/cert/host pivots
• Spur — IP lookups and tracking
• Robtex — Passive DNS and infrastructure pivots

ASN/BGP & Internet Measurement

• Hurricane Electric BGP Toolkit — ASN, prefix, peers, IRR data
• RIPEstat — IP/ASN history, routing, geolocation, abuse contacts
• BGPView — ASN and prefix explorer
• bgp.tools — Clean ASN/IX views, routing details
• PeeringDB — Facility and peering info

Certificates & CT Monitoring

• crt.sh — Search Certificate Transparency logs
• Censys Certificates — CT and x509 attribute pivots
• CertStream — Real-time CT feed via WebSocket
• Rapid7 Open Data — Sonar DNS/HTTP/SSL datasets
• Cert Spotter [Freemium] — CT monitoring and alerts
• Favicon hash (mmh3): cluster infrastructure; pair with Shodan/Censys favicon search

---

Threat Intel & IOCs

• Vendor/CERT advisories: CISA/NSA/CSA joint advisories, CERT-EU, NCSC-UK, JPCERT/CC, CERT-UA
• MISP Project and public MISP feeds
• OpenCTI — CTI knowledge graph
• Malpedia — Malware families, YARA, references
• ThreatFox / URLHaus / SSLBL
• MalwareBazaar — Hash-based sample sharing
• PhishTank / OpenPhish

Malware Analysis & Sandboxes

• Static analysis: pefile, FLOSS, capa
• Similarity: SSDEEP, TLSH
• Sandboxes: ANY.RUN, Hybrid Analysis, CAPE, Tria.ge
• Intelligence: Intezer (code reuse), VirusTotal (caution: uploads become public)
• TLS fingerprints: JA3, JA4

---

Cryptocurrency OSINT

Blockchain Explorers

| Chain | Explorer | |-------|---------| | Bitcoin | Blockchain.com, Blockchair | | Ethereum | Etherscan | | BNB Chain | BSCScan | | Polygon PoS | PolygonScan | | Solana | Solscan | | Multi-chain | OKLink [Freemium], Cielo |

**L2 Expl