programmatic-osint-sources

name

programmatic-osint-sources

description

Catalog of data-rich OSINT/enrichment sources that can be pulled PROGRAMMATICALLY with low lift — a public URL endpoint, a keyless REST API, or a genuine free-tier API. Use when you have an identifier (email, name, domain, username, phone, company, or IP) and want to turn it into rich machine-readable data: find or verify emails, reverse-lookup a person from an email, enumerate subdomains and infrastructure, check breach/credential exposure, resolve a company to officers/beneficial owners, confirm an account exists on a platform, enrich a phone number, or pivot an identity across ecosystems. Generalizes the "Gravatar returns a profile from an email" trick to hundreds of sources. Covers keyless endpoints, free-key APIs, and cheap paid upgrades, each with a concrete example call and honest auth/ToS/freshness caveats.

Programmatic OSINT Sources

The idea: an identifier (email · name · domain · username · phone · company · IP) keys into a rich, machine-readable response. This skill is a curated, verified catalog of sources where that pull is low-lift — a plain URL, a keyless API, or a real free-tier key — so an agent can script it. It generalizes the Gravatar "email → profile" trick out to breach data, infrastructure, code repos, public records, presence oracles, phones, and more.

This is the broad source catalog. For the email-specific workflow (DNS/MX, theHarvester, holehe, GHunt, SMTP/people-API verification, Gravatar/Libravatar/unavatar) see the sibling skill domain-email-enumeration. This skill covers everything outside that email-and-avatar core.

---

How to use this skill

1. Start from the identifier you already have. The catalog is organized so you can jump to "I have an X, I want a Y":

   I have…	I want…	Go to
   email	is it breached? / infostealer exposure	breach-and-exposure
   email	the person behind it (name/role/socials)	contact-enrichment · presence-oracles
   name + company/domain	a verified work email	contact-enrichment
   domain	subdomains, hosts, tech, related infra	infrastructure-recon
   domain / company	officers, owners, filings, litigation	public-records
   company name	canonical domain + firmographics + IDs	contact-enrichment · market-signals
   company	hiring intent, tech stack, ad/news signal	market-signals
   username / handle	linked accounts, real name, activity	presence-oracles · developer-identity
   name / org / email	public code commits → real emails	developer-identity
   phone number	carrier, line type, name, platform footprint	phone-and-messaging

2. Prefer keyless → free-key → cheap-paid, in that order. Every entry is tagged. Reach for a paid tier only when a keyless one can't answer.

3. Chain sources into a waterfall. e.g. company name → canonical domain (Clearbit autocomplete) → subdomains (Cert Spotter) → contributor emails (GitHub) → verify (Abstract) → enrich the person (People Data Labs) → confirm they're active (Duolingo/Keybase). The reference files note what feeds what.

4. Re-verify before you rely on it. These endpoints churn — free tiers shrink, hosts move, ToS changes. Freshness/confidence caveats are on every entry; treat pricing and free-quota numbers as "last-checked, re-check now."

---

Highest-value keyless sources (zero auth, start here)

The fastest wins — no signup, scriptable in one curl. Full details + more in the reference files.

Source	Identifier → data	Category
Hudson Rock Cavalier	email/domain → infostealer-infection exposure	breach
XposedOrNot	email → breaches + risk score	breach
LeakCheck (public)	email/username/phone → breach source names + PII categories	breach
crt.sh / Cert Spotter	domain → subdomains (from CT logs)	infra
Shodan InternetDB	IP → ports, CVEs, hostnames	infra
RDAP (rdap.org)	domain/IP/ASN → registrar, dates, nameservers, ownership	infra
HackerTarget	domain ↔ subdomains / reverse-IP	infra
RIPEstat	IP/ASN/prefix → whois, abuse contact, routing, geo	infra
Common Crawl index	domain → web-scale URL/subdomain list + page text	infra
GitHub commit/patch	name/org/email ↔ username + real commit emails	dev

---

Reference catalog

Load the file for the category you need — see references/INDEX.md for the map.

• breach-and-exposure.md — credential leaks, infostealer exposure, paste/darkweb archives.
• infrastructure-recon.md — certificate transparency, internet-scan engines, DNS/RDAP/WHOIS, passive DNS, ASN/abuse contacts, web-index/history.
• developer-identity.md — GitHub/GitLab/npm/PyPI/Sourcegraph/GH-Archive: code repos as an email↔identity graph.
• contact-enrichment.md — B2B email finders, email validation, firmographic resolvers, knowledge graphs (Wikidata), academic identity (ORCID/OpenAlex).
• public-records.md — government/legal/financial registries: officers, beneficial owners, donors, filings, litigation, procurement.
• presence-oracles.md — identifier → "real person + profile" existence checks across consumer platforms (the direct generalization of the Gravatar trick).
• phone-and-messaging.md — phone → carrier/line-type/name, and messaging-app footprint (Telegram/Discord/X/WhatsApp/Signal).
• market-signals.md — hiring signals (job boards), news (GDELT), ad transparency, maps/reviews, tech-fingerprint.
• connectors.md — how to get this data via Claude connectors / MCP servers instead of raw curl, prioritized free / no-account / low-lift (what's already connected, 1-click directory options, remote-URL MCPs, and self-host power tools).

---

Legal, ToS & ethics (read before scripting)

This skill is for authorized work: B2B prospecting on business contacts, defensive security / threat intelligence, due diligence, and competitive research. With that scope:

• Respect each source's ToS and rate limits. Many keyless endpoints (Duolingo, X syndication, Truecaller, LinkedIn Voyager, WhatsApp self-sessions) are undocumented or explicitly forbid automation. They're fine for low-volume investigative pivots; they are not for bulk scraping, and some carry account-ban or legal risk (LinkedIn hiQ, Truecaller). Each entry flags this — heed it.
• Breach / infostealer / credential data is defensive. Hudson Rock, HIBP, DeHashed, ProxyNova COMB, Intelligence X etc. exist for exposure assessment and threat intel. Use them to protect a domain you're authorized on or assess a counterparty's risk — never to obtain or use others' credentials. Treat any returned plaintext as toxic.
• Handle PII responsibly. Much of this is personal data (home addresses in FEC/registry data, phone→name, breach records). Collect only what the task needs, store it as your engagement's rules require, and honor GDPR/CCPA where they apply.
• No secrets in the repo. Every example uses a $ENV_VAR or placeholder key. Never commit a real key, token, or cookie.

If a task would use these sources to target a private individual rather than a business context, or in a way the user wouldn't expect, stop and confirm scope first.

---

Related skills

• domain-email-enumeration — the email/avatar core (theHarvester, holehe, GHunt, SMTP/people-API verification, Gravatar).
• client-discovery-osint · intelligence-dossier · verification-audit · company-legal-reputation-research — workflows that consume these sources.
• website-techstack-analysis · google-dorking-osint — adjacent recon techniques.

Freshness: catalog compiled 2026-07; API availability, free tiers, and pricing change frequently. Re-check any endpoint before depending on it, and downgrade your confidence for entries tagged [shaky].