OSINT Recon

Open Source Intelligence investigation and reconnaissance workflows.

how to use

• /osint-recon Apply OSINT methodology to the current investigation.

• /osint-recon <target-type> Plan an OSINT investigation for username, domain, email, or organization.

when to apply

Reference these guidelines when:

• investigating usernames or email addresses
• performing domain intelligence gathering
• conducting threat intelligence research
• analyzing social media footprints
• mapping organizational structure
• participating in OSINT CTF challenges

investigation methodology

OSINT Cycle

1. Planning: Define objectives, scope, legal constraints
2. Collection: Gather raw data from open sources
3. Processing: Clean, normalize, deduplicate data
4. Analysis: Correlate findings, identify patterns
5. Dissemination: Report findings with confidence levels
6. Feedback: Refine collection based on gaps

Evidence Classification

Level	Description	Example
Confirmed	Multiple independent sources	Username + email + profile photo match
Probable	Strong single source or partial corroboration	Username match + similar bio
Possible	Single weak source	Username exists on platform
Doubtful	Contradictory or unreliable	Common username, no distinguishing info

username enumeration

Sherlock-Style Patterns

# Pattern: Multi-platform username check
import asyncio
import aiohttp
from typing import TypedDict

class UsernameResult(TypedDict):
    platform: str
    url: str
    status: str  # "found", "not_found", "error"
    response_time_ms: float

PLATFORMS = {
    "github": "https://github.com/{username}",
    "twitter": "https://x.com/{username}",
    "instagram": "https://instagram.com/{username}",
    "reddit": "https://reddit.com/user/{username}",
    "linkedin": "https://linkedin.com/in/{username}",
    "medium": "https://medium.com/@{username}",
    "dev.to": "https://dev.to/{username}",
    "hackernews": "https://news.ycombinator.com/user?id={username}",
}

async def check_username(
    session: aiohttp.ClientSession,
    platform: str,
    url: str,
) -> UsernameResult:
    """Check if username exists on a platform."""
    try:
        async with session.get(url, timeout=aiohttp.ClientTimeout(total=10)) as resp:
            return {
                "platform": platform,
                "url": url,
                "status": "found" if resp.status == 200 else "not_found",
                "response_time_ms": 0,
            }
    except Exception:
        return {"platform": platform, "url": url, "status": "error", "response_time_ms": 0}

Key Tools

• Sherlock: Username enumeration across 400+ sites
• WhatsMyName: Web-based username search
• Namechk: Domain + username availability

domain intelligence

DNS & WHOIS

# DNS enumeration
dig +short A example.com
dig +short MX example.com
dig +short TXT example.com
dig +short NS example.com

# WHOIS
whois example.com

# Subdomain enumeration
# Tools: subfinder, amass, sublist3r
subfinder -d example.com -silent

# Certificate transparency
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq '.[].name_value'

Technology Fingerprinting

• Wappalyzer: Browser extension for tech stack detection
• BuiltWith: Historical technology data
• Shodan: Internet-connected device search
• Censys: Certificate and host search

email intelligence

Email Verification Patterns

# Pattern: Email OSINT workflow
def email_osint(email: str) -> dict:
    """Gather intelligence from an email address."""
    local_part, domain = email.split("@")
    return {
        "email": email,
        "domain_info": {
            "mx_records": dns_lookup(domain, "MX"),
            "spf_record": dns_lookup(domain, "TXT", filter="spf"),
            "dmarc_record": dns_lookup(f"_dmarc.{domain}", "TXT"),
        },
        "breach_check": "Use HaveIBeenPwned API",
        "social_profiles": "Cross-reference with username enumeration",
        "domain_age": "WHOIS creation date",
    }

Tools

• theHarvester: Email, subdomain, name harvesting
• Hunter.io: Email pattern discovery
• HaveIBeenPwned: Breach exposure check

dark web intelligence

CTI Feed Sources (from DeepDarkCTI)

Source Type	Examples	Use Case
Paste sites	Pastebin, GhostBin	Credential leaks, data dumps
Forums	Monitored via threat intel platforms	Threat actor discussion
Marketplaces	Tracked by law enforcement	Compromised data sales
Telegram	Public channels	Real-time threat chatter
Discord	Public servers	Community threat intel

CTI Integration Pattern

# Pattern: CTI feed aggregation
from dataclasses import dataclass
from datetime import datetime
from enum import Enum

class ThreatLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class ThreatIndicator:
    ioc_type: str  # ip, domain, hash, email, url
    ioc_value: str
    source: str
    threat_level: ThreatLevel
    first_seen: datetime
    context: str
    confidence: float  # 0.0 - 1.0

social media analysis

Profile Analysis Framework

1. Account metadata: Creation date, follower/following ratio, posting frequency
2. Content analysis: Topics, sentiment, language patterns
3. Network analysis: Connections, group memberships, interactions
4. Temporal analysis: Activity patterns, time zones, posting schedules
5. Cross-platform correlation: Matching profiles across platforms

OSINT Workflow Template (from Obsidian OSINT Templates)

## Investigation: {{target}}
**Date**: {{date}}
**Objective**: {{objective}}
**Scope**: {{scope}}

### Findings
| Source | Data Point | Confidence | Notes |
|--------|-----------|------------|-------|

### Timeline
| Date | Event | Source |

### Connections Map
[Graph of relationships between entities]

### Assessment
**Confidence Level**: Confirmed / Probable / Possible / Doubtful
**Summary**:
**Recommendations**:

data correlation techniques

Entity Resolution

# Pattern: Cross-source entity matching
def correlate_entities(sources: list[dict]) -> list[dict]:
    """Match entities across different OSINT sources."""
    # Exact matches: email, phone, unique IDs
    # Fuzzy matches: names (Levenshtein), usernames (substring)
    # Behavioral matches: writing style, posting times
    # Visual matches: profile photo reverse image search
    ...

Pivot Points

• Username → email → real name → address
• Domain → IP → other domains (reverse DNS)
• Phone → social media → real identity
• Image → EXIF data → GPS coordinates → other photos

integration with the operator's environment

Component	Integration
memory MCP server	Store entities, relations, observations as investigation graph
security-auditor agent	Automate reconnaissance for security assessments
PostToolUse hook	All OSINT commands logged in audit.log
sequential MCP	Step-by-step reasoning for complex correlations
CoreMind security layer	Hash chain audit trail for investigation activities

Using Memory MCP for Investigations

# Store investigation entities
mcp__memory__create_entities: [{name: "target_user", entityType: "person", observations: ["..."]}]
mcp__memory__create_relations: [{from: "target_user", to: "target_domain", relationType: "owns"}]
mcp__memory__search_nodes: {query: "target investigation"}

legal and ethical guidelines

1. Only use publicly available information
2. Never access private accounts or systems without authorization
3. Respect robots.txt and rate limits (see browser-automation-safety skill)
4. Document your methodology for reproducibility
5. Report findings responsibly (coordinated disclosure)
6. Comply with local privacy laws (GDPR, CCPA, etc.)
7. Never harass or stalk individuals

cross-references

• offensive-security skill: Full penetration testing methodology
• security-review skill: Code-level security analysis
• browser-automation-safety skill: Rate limiting, robots.txt compliance
• research-methodology skill: Source credibility assessment
• SECURITY_ARSENAL.md: Complete tool inventory