| name | programmatic-osint-sources |
| description | Catalog of data-rich OSINT/enrichment sources that can be pulled PROGRAMMATICALLY with low lift — a public URL endpoint, a keyless REST API, or a genuine free-tier API. Use when you have an identifier (email, name, domain, username, phone, company, or IP) and want to turn it into rich machine-readable data: find or verify emails, reverse-lookup a person from an email, enumerate subdomains and infrastructure, check breach/credential exposure, resolve a company to officers/beneficial owners, confirm an account exists on a platform, enrich a phone number, or pivot an identity across ecosystems. Generalizes the "Gravatar returns a profile from an email" trick to hundreds of sources. Covers keyless endpoints, free-key APIs, and cheap paid upgrades, each with a concrete example call and honest auth/ToS/freshness caveats. |
Programmatic OSINT Sources
The idea: an identifier (email · name · domain · username · phone · company · IP)
keys into a rich, machine-readable response. This skill is a curated, verified catalog
of sources where that pull is low-lift — a plain URL, a keyless API, or a real
free-tier key — so an agent can script it. It generalizes the Gravatar
"email → profile" trick out to breach data, infrastructure, code repos, public
records, presence oracles, phones, and more.
This is the broad source catalog. For the email-specific workflow (DNS/MX, theHarvester,
holehe, GHunt, SMTP/people-API verification, Gravatar/Libravatar/unavatar) see the sibling
skill domain-email-enumeration. This skill covers
everything outside that email-and-avatar core.
How to use this skill
-
Start from the identifier you already have. The catalog is organized so you can jump to
"I have an X, I want a Y":
| I have… | I want… | Go to |
|---|
| email | is it breached? / infostealer exposure | breach-and-exposure |
| email | the person behind it (name/role/socials) | contact-enrichment · presence-oracles |
| name + company/domain | a verified work email | contact-enrichment |
| domain | subdomains, hosts, tech, related infra | infrastructure-recon |
| domain / company | officers, owners, filings, litigation | public-records |
| company name | canonical domain + firmographics + IDs | contact-enrichment · market-signals |
| company | hiring intent, tech stack, ad/news signal | market-signals |
| username / handle | linked accounts, real name, activity | presence-oracles · developer-identity |
| name / org / email | public code commits → real emails | developer-identity |
| phone number | carrier, line type, name, platform footprint | phone-and-messaging |
-
Prefer keyless → free-key → cheap-paid, in that order. Every entry is tagged. Reach for a
paid tier only when a keyless one can't answer.
-
Chain sources into a waterfall. e.g. company name → canonical domain (Clearbit autocomplete)
→ subdomains (Cert Spotter) → contributor emails (GitHub) → verify (Abstract) → enrich the
person (People Data Labs) → confirm they're active (Duolingo/Keybase). The reference files note
what feeds what.
-
Re-verify before you rely on it. These endpoints churn — free tiers shrink, hosts move,
ToS changes. Freshness/confidence caveats are on every entry; treat pricing and free-quota
numbers as "last-checked, re-check now."
Highest-value keyless sources (zero auth, start here)
The fastest wins — no signup, scriptable in one curl. Full details + more in the reference files.
| Source | Identifier → data | Category |
|---|
| Hudson Rock Cavalier | email/domain → infostealer-infection exposure | breach |
| XposedOrNot | email → breaches + risk score | breach |
| LeakCheck (public) | email/username/phone → breach source names + PII categories | breach |
| crt.sh / Cert Spotter | domain → subdomains (from CT logs) | infra |
| Shodan InternetDB | IP → ports, CVEs, hostnames | infra |
| RDAP (rdap.org) | domain/IP/ASN → registrar, dates, nameservers, ownership | infra |
| HackerTarget | domain ↔ subdomains / reverse-IP | infra |
| RIPEstat | IP/ASN/prefix → whois, abuse contact, routing, geo | infra |
| Common Crawl index | domain → web-scale URL/subdomain list + page text | infra |
| GitHub commit/patch | name/org/email ↔ username + real commit emails | dev |
Reference catalog
Load the file for the category you need — see references/INDEX.md for the map.
- breach-and-exposure.md — credential leaks, infostealer exposure, paste/darkweb archives.
- infrastructure-recon.md — certificate transparency, internet-scan engines, DNS/RDAP/WHOIS, passive DNS, ASN/abuse contacts, web-index/history.
- developer-identity.md — GitHub/GitLab/npm/PyPI/Sourcegraph/GH-Archive: code repos as an email↔identity graph.
- contact-enrichment.md — B2B email finders, email validation, firmographic resolvers, knowledge graphs (Wikidata), academic identity (ORCID/OpenAlex).
- public-records.md — government/legal/financial registries: officers, beneficial owners, donors, filings, litigation, procurement.
- presence-oracles.md — identifier → "real person + profile" existence checks across consumer platforms (the direct generalization of the Gravatar trick).
- phone-and-messaging.md — phone → carrier/line-type/name, and messaging-app footprint (Telegram/Discord/X/WhatsApp/Signal).
- market-signals.md — hiring signals (job boards), news (GDELT), ad transparency, maps/reviews, tech-fingerprint.
- connectors.md — how to get this data via Claude connectors / MCP servers instead of raw
curl, prioritized free / no-account / low-lift (what's already connected, 1-click directory options, remote-URL MCPs, and self-host power tools).
Legal, ToS & ethics (read before scripting)
This skill is for authorized work: B2B prospecting on business contacts, defensive
security / threat intelligence, due diligence, and competitive research. With that scope:
- Respect each source's ToS and rate limits. Many keyless endpoints (Duolingo, X syndication,
Truecaller, LinkedIn Voyager, WhatsApp self-sessions) are undocumented or explicitly forbid
automation. They're fine for low-volume investigative pivots; they are not for bulk
scraping, and some carry account-ban or legal risk (LinkedIn
hiQ, Truecaller). Each entry
flags this — heed it.
- Breach / infostealer / credential data is defensive. Hudson Rock, HIBP, DeHashed, ProxyNova
COMB, Intelligence X etc. exist for exposure assessment and threat intel. Use them to protect a
domain you're authorized on or assess a counterparty's risk — never to obtain or use others'
credentials. Treat any returned plaintext as toxic.
- Handle PII responsibly. Much of this is personal data (home addresses in FEC/registry data,
phone→name, breach records). Collect only what the task needs, store it as your engagement's
rules require, and honor GDPR/CCPA where they apply.
- No secrets in the repo. Every example uses a
$ENV_VAR or placeholder key. Never commit a
real key, token, or cookie.
If a task would use these sources to target a private individual rather than a business
context, or in a way the user wouldn't expect, stop and confirm scope first.
Related skills
Freshness: catalog compiled 2026-07; API availability, free tiers, and pricing change
frequently. Re-check any endpoint before depending on it, and downgrade your confidence for
entries tagged [shaky].
