useosint/osint-skills

Dig Through Data Brokers uses people-search sites and public records to turn a name into candidate addresses, phones, relatives, and background details, then confirm them against primary sources. Use it for skip tracing, reverse address lookups, self-audits, and broker data removal.

Find Anyone builds a sourced profile of one specific person from public records, professional profiles, court filings, and other open sources. It is used to identify, verify, or background-check someone while avoiding name-mixups.

Find Exposed Servers uses Shodan, Censys, and similar scan data to identify internet-facing hosts, ports, services, and devices without touching the target. Use it for exposure checks, origin-IP pivots, and Shodan query syntax.

Find Hidden Subdomains enumerates an organization’s subdomains and sibling domains from Certificate Transparency logs and passive DNS without sending traffic to the target. Use it to map hostnames, find staging or admin systems, and spot newly issued certificates.

Find Leaks In The Wild helps check whether a name, email, domain, or credential is circulating in pastes, forums, and Telegram, and whether a claimed leak is genuine or a recycled combolist. Use it for breach triage, threat intelligence, and leak monitoring.

Find The Original Image uses multiple reverse image search engines to trace an image to its earliest known publication and read the source page. Use it to identify photos, logos, places, profile pictures, reposts, or video keyframes.

Follow The Crypto traces Bitcoin and Ethereum addresses and transactions across public blockchains using explorers and clustering heuristics. Use it to track ransom or scam payments, find off-ramps, and screen addresses for sanctions or fraud.

Geolocate From Pixels identifies where and when a photo or video was taken from visual clues like signs, plates, roads, poles, vegetation, and shadows. Use it to verify a claimed location or estimate time without GPS or EXIF.

Google Like a Spy crafts advanced search queries and dorks to find exposed files, documents, mentions, and public directory listings. Use it for OSINT, leak hunting, and recon across search engines and document repositories.

Graph The Network helps build an entity-relationship graph for investigations with typed nodes, edge provenance, confidence, aliases, and time bounds. Use it when a list has grown into a network and you need shared infrastructure, bridges, or the real principal behind a frontman.

Hunt A Handle enumerates a username across many platforms and helps correlate which accounts likely belong to the same person. Use it for handle OSINT, cross-platform account checks, and turning a screen name into leads for further verification.

Investigate Anything routes open-source investigations from a starting selector to the right workflow and sets scope, collection, source grading, and hypothesis testing. Use it to turn vague OSINT or due-diligence requests into a documented plan.

Investigate Without Getting Made helps investigators reduce attribution risk by separating research identity from real identity and managing IP, browser, TLS, timing, and account exposure. Use it when viewing sensitive targets, creating personas, or choosing between VPN, proxy, or Tor.

Is This Photo Real verifies whether an image or video is authentic, original, and correctly captioned using provenance checks, metadata, and visual forensics. Use it when fact-checking media, checking for manipulation or deepfakes, or testing whether footage is recycled or miscaptioned.

Passive Domain Recon builds an asset inventory for a domain, website, or IP from registration, DNS, subdomains, infrastructure, history, and ownership without contacting the target. Use it to profile an organization, assess exposure, or investigate a suspicious site quietly.

Pattern Of Life From Socials analyzes public social accounts for metadata, network ties, content clues, and posting-time habits. Use it to profile an account, map associates, infer routine or timezone, or archive a profile before deletion.

Read Deleted Pages recovers deleted, edited, or historical web content from the Wayback Machine, archive.today, Common Crawl, and Memento tools. Use it to compare old versions, enumerate archived URLs, or preserve evidence before a page disappears.

Secrets In File Metadata extracts EXIF, XMP, IPTC, Office, and PDF metadata with exiftool to identify device details, timestamps, locations, and provenance clues. Use it when checking who created a file, where a photo was taken, or whether a document was edited.

Secrets In Git History mines commit history, refs, and code-host metadata for identities, infrastructure, and leaked credentials. Use it to find API keys, enumerate contributors, or recover secrets deleted from HEAD but still present in history or forks.

Track Planes And Ships uses public ADS-B and AIS sources to follow aircraft and vessels by durable identifiers, registry data, and movement history. Use it for asset tracing, sanctions-evasion checks, supply-chain compliance, and investigative reporting.

UseOSINT routes names, handles, domains, photos, phones, and other identifiers to the right open-source investigation workflow after scope is set. Use it for lawful verification, due diligence, attribution, and intelligence reporting.

What An Email Reveals investigates an email address with MX and syntax checks, Gravatar lookup, corporate format inference, breach exposure, and mail-header analysis. Use it for email OSINT, phishing triage, vendor verification, and tracing suspicious messages.

What Leaked About You checks breach exposure for an email, username, phone, or name using HIBP, Pwned Passwords, and commercial breach-search services. Use it to map account exposure, interpret leak records, and audit personal or client data without touching leaked credentials.

Where Was This Taken establishes where and when a photo or video was captured and checks whether it appears authentic. Use it for location verification, provenance tracing, chronolocation, and manipulation checks before relying on media.

Who Owns This Domain helps determine who registered and who operates a domain using WHOIS, RDAP, and DNS records. Use it for attribution, phishing checks, vendor verification, and domain-dispute evidence.