Synthesis — OSINT

The evolving thesis. Spun out of the hub _inbox security/OSINT cluster on 2026-06-30 from three sources: two AI-OSINT tools (llm-osint, the single-LLM proof-of-concept parked first; kallisto-osinter, the multi-agent orchestrator) and one social-engineering resource list (awesome-social-engineering).

Current thesis

OSINT is reconnaissance, and LLMs are automating the analyst out of the loop. The field has a manual toolkit — Maltego, theHarvester, Shodan, recon-ng — each automating one slice of finding and correlating public data, but gated by an analyst’s time: a human runs the tools, reads the output, and decides what to chase. The founding AI tools dissolve that bottleneck along a clear autonomy axis:

1. Single-LLM loop — llm-osint gives one model a target; it searches, reads, and assembles a profile itself. The minimal proof the pattern works.
2. Multi-agent orchestration — kallisto-osinter splits the job across a search agent, a knowledge-orchestration agent, and specialized deep-dive agents, with LLM map-reduce over large pages. The same monolithic-→-orchestrated move agent frameworks make generally, pointed at recon.

So the trajectory is manual recon stack → LLM-automated gathering → multi-agent deep investigation (ai-osint). The manual toolkit doesn’t disappear; it becomes the substrate the agents drive.

OSINT and social-engineering are one chain. OSINT is the reconnaissance phase; social engineering is the act it enables — a pretext is only as credible as the recon behind it. So automating OSINT doesn’t just speed up investigation, it lowers the cost of the reconnaissance behind human-element attacks. The two halves of the founding corpus (AI-OSINT tools + the social-engineering resource base) meet exactly here.

A defensive counter-current — OSINT as a feed, not a verdict. The “automate the analyst away” reading is only one direction. kafsiem (Scalytics) runs the opposite play: it treats OSINT as an input fused with operational/OT data into an auditable entity graph with provenance on every edge, which a human analyst then reasons over. So the field has two poles — autonomous gathering (llm-osint/ kallisto-osinter, analyst-out-of-loop, black-box profile) and analyst-driven fusion (kafsiem, analyst-in-loop, every edge traceable). The provenance/audit discipline is a direct rebuttal to the black-box-profiler hazard, and it pulls the spoke past pure offensive recon toward defensive threat-intelligence.

A second axis: what the recon is of. The autonomy axis (above) sorts tools by how much of the analyst’s loop they absorb. swaggerspy exposes a different axis — the target of the recon. The founding tools all profile people (llm-osint, kallisto-osinter) or catalog human-element technique (awesome-social-engineering); SwaggerSpy instead harvests machine secrets — leaked credentials in published SwaggerHub API docs — a Shodan-class attack-surface sweep, not a person lookup. It’s also a reminder the AI wave hasn’t replaced the classic mode: SwaggerSpy is plain regex over one platform, no LLM. So the spoke now spans two independent axes — autonomy (manual → single-LLM → multi-agent) and object (person-profiling ↔ secrets/attack-surface) — and the corpus is starting to fill the offensive-security-recon breadth the scope boundary anticipated, not just the AI-OSINT corner.

gitsint fills the missing cell of that grid. SwaggerSpy proved the non-AI, single-platform mode on the secrets side; GitSint is the same mode on the person-profiling side — one platform (GitHub), worked exhaustively through its API and public repos, no LLM. So “classic, one-platform enumeration” is a mode that spans both objects, not a quirk of secrets-hunting. GitSint also adds a correlation primitive the people-profilers assumed but never mechanized on a specific platform: the email ↔ identity pivot. GitHub is unusually exposed to it because Git embeds an author email in every commit, so GitSint harvests commit history to map an account to a real email and (in reverse) an email to an account. Depth on one data-rich platform substitutes for the AI tools’ breadth across the open web — a third way to cut the space, alongside autonomy and object.

The corpus finally has a standard and a measurement, and they agree. Until 2026-08-07 every source here was a capability describing itself: a repo, a vendor page, a curated list. Two T1 sources landed together and both push against the autonomy pole from outside the tooling. The Berkeley Protocol (OHCHR + UC Berkeley Human Rights Center) is the field’s written professional standard, and its three axes are professional, legal, ethical — not accuracy, not coverage. The CSIR ECCWS study is the field’s first measurement in this corpus: eight LLMs scored against a fabricated organization with known ground truth, on accuracy, attribution, traceability and hallucination.

They arrive at the same place from opposite directions. The Protocol says the analyst is a duty; the study says the analyst is a control — because models prompted adversarially perform forced narrative construction, building the story the investigator leaned toward. So “keep the human in the loop” stops being kafsiem‘s design taste and becomes a requirement with an institutional owner on one side and a measured failure mode on the other. That is the strongest claim this spoke can now make, and it cuts directly against the trajectory the rest of the thesis describes.

One asymmetry to keep visible: the study scores models given evidence, not the autonomous gatherers. llm-osint and kallisto-osinter collect as well as analyse, and nothing here measures collection. The analysis half has a number; the collection half is still self-asserted.

The defining tension: dual-use

Everything here is dual-use. Aggregating public data feels benign, but assembling fragments into a profile is where privacy harm and surveillance risk concentrate — and automation makes it cheap, fast, and scalable. “Person lookups with psychological profiling” (kallisto-osinter) is a capability for an authorized investigator and a weapon for a stalker or a mass-surveillance operator with the same code. This spoke documents the field for defense, education, and research — the tools and their implications — not to target real people; it foregrounds consent, privacy, ethics, and defense rather than operational playbooks.

The dual-use case sharpens: from gathering to acting (strix)

The section above frames the hazard as automated profiling. strix moves it a step down the chain: ~44.8k★, Apache 2.0, one-line install, runs on a consumer ChatGPT subscription or a local model, and its agents exploit rather than observe. The dual-use argument this spoke has been making about cheap profiling now applies to cheap exploitation, with a much larger user base and a commercial vendor behind it (usestrix).

Two things keep it from being a simple escalation. The delivery model is defensive by default — CI on your own pull requests, patches offered back — which is myip‘s inversion again at a different layer: point the capability at yourself. And the evidence discipline improves going this direction, because an exploit is self-verifying where a profile is not (autonomous-pentesting).

What doesn’t improve is the boundary. Authorization is a README warning, with no technical scope enforcement and nothing distinguishing your staging host from someone else’s production. The spoke’s standing ethics position (catalog and analyze; no operational playbooks against real targets) is unchanged, and the observation to record is narrower and more useful than alarm: the cost floor for automated exploitation is now a subscription, and consent remains a convention.

A second risk: source contamination, not just privacy

The dual-use section frames the hazard as aggregation harm — public fragments assembled into a profile. The encyclopedic overview osint-overview-wikipedia names a distinct one: disinformation vulnerability. Open sources can be deliberately poisoned — extremist groups and state actors plant false information — so OSINT’s problem is also input trustworthiness under an information explosion. This bites hardest on the autonomous pole: an LLM that gathers and trusts public data at scale (llm-osint, kallisto-osinter) is precisely the target a planted-information campaign wants, which reframes kafsiem‘s provenance-on-every-edge discipline as a defense against bad input, not only a black-box-profiler check. So the spoke now carries two risk axes — privacy/consent (output) and source integrity (input).

Open questions

• Where does the human stay in the loop? Autonomous profiling raises accuracy, accountability, and consent questions the gathering tools don’t answer. Partial answer (2026-06-30, kafsiem): the analyst-driven, provenance-on-every-edge model keeps the human central and every claim auditable — one design response, though the autonomous tools (llm-osint PoC, kallisto-osinter ~8★) still don’t. Largely answered (2026-08-07) from two directions at once, both T1 and neither a tool: the Berkeley Protocol makes analyst duty a published standard for human-rights investigations, and the CSIR ECCWS study shows why by measuring the failure — adversarially prompted models construct the narrative they are led toward, so oversight is the control for a demonstrated defect rather than a preference. Residual: neither covers autonomous collection, and no source here says what oversight costs or how much of the speed advantage it gives back.
• Defense against automated OSINT. Opened (2026-06-30, kafsiem). The defensive side now has a first source: fusing OSINT with operational data into an auditable entity graph for analysts, with an OT / critical-infrastructure / SCADA focus. Residual: data minimization, deception, and detecting automated profiling are still unsourced — the defensive thread has a seed, not a corpus. Second, at the other end of the scale (2026-07-27, myip): kafsiem defends an organization with an analyst driving it; MyIP is one person checking one connection, self-hostable, with no analyst and no case file. It answers “what do I disclose right now” by running the recon primitives against their own address and naming the three leaks that survive a VPN (WebRTC, DNS, browser fingerprint). Data minimization is still unsourced; exposure awareness now has a working artifact.
• Governance seam. Privacy/surveillance regulation of these capabilities is ../ai-governance-wiki’s domain — where does law (GDPR-style data protection, surveillance limits) bite on AI-OSINT? Cross-spoke.
• How far past OSINT? The corpus leans AI-OSINT + social-engineering recon. Broaden toward general offensive-security / threat-intel / defensive recon if more sources arrive, rather than fragment. First step taken (2026-07-02, swaggerspy): a non-AI, secrets-scanning recon tool — the corpus is edging into general offensive-security recon (secrets/attack-surface), beyond people-profiling. Second step (2026-07-05, gitsint): a non-AI, single-platform people-profiler — GitHub enumeration with commit-history email harvesting. Confirms the classic-mode corner is a real breadth, and surfaces the email ↔ identity pivot as a correlation primitive worth its own thread if more identity-resolution tooling lands. Answered, at the far end (2026-07-27, strix): a full autonomous pentesting agent — recon, exploitation, post-exploitation, PoC validation — where reconnaissance is one agent’s subroutine. The corpus now spans gather → act, so “how far past OSINT” has a concrete answer: as far as the whole offensive chain. Per the spoke’s standing instruction this is a reason to broaden the domain rather than fragment; three offensive-security sources (swaggerspy, gitsint, strix) now sit here, and if the exploitation corner keeps growing the domain line in CLAUDE.md should be widened to say so explicitly.
• Who is actually running these tools? Opened 2026-08-03 by termux-commands-site. The corpus has read tools and techniques; this is its first source about an audience — beginners on phones, arriving through search for a copy-pasteable command. One SEO-driven site is thin evidence for a population, and nothing here measures how many people follow the instructions. Adjacent and unsourced: whether the tool authors intend this reach, and whether phone-based recon shows up on the defensive side as distinguishable traffic (current answer, from the distribution-axis section: it doesn’t).

The census, and what it says the corpus has been missing (awesome-osint-list)

Every source here until now was one instrument. Astrosp’s list is the first that shows the whole toolkit at once — ~1,730 links, ~90 sections — and three things in its shape contradict or qualify what the spoke had concluded from the instruments.

One: the field is mostly hosted services, not repositories. The modal entry is a website you open (Dehashed, Intelligence X, GreyNoise, people-search, flight/maritime trackers, sanctions and most-wanted search engines, dozens of Google CSEs). Everything in this corpus except termux-commands-site is code you clone and run. That is a selection bias with a mundane cause — GitHub links are what arrive — and it matters because the two classes fail differently: a repo is auditable and offline-capable, a hosted service logs you, can change its results without notice, and can disappear. The corpus has been theorizing from the auditable minority.

Two: the AI section is mostly AI as the target, not the analyst. Of eleven subsections, one is “AI for OSINT & Threat Intelligence”; the bulk is general assistants plus a substantial LLM-security block — vulnerability testing, red teaming, jailbreak and prompt-injection resources, model and dataset security. The spoke calls ai-osint its leading edge and that still looks right as a trajectory, but this is the first evidence about the base rate, and the base rate says automated profiling is not yet how the work is done. Held against llm-osint‘s and kallisto-osinter‘s self-asserted capability, it sharpens growth edge 2 rather than answering it: nobody has measured either the accuracy or the adoption.

Three: the practitioners’ own boundary is already the whole offensive chain. The file ends with a bug-bounty wing — attack-surface discovery, enumeration, scanning, fuzzing, API testing, exploitation frameworks — filed as part of OSINT, not next to it. swaggerspy, gitsint and strix pushed this spoke that way one source at a time and each time it read as a judgement call. It isn’t; it’s the field’s own filing.

A fourth thing is not a finding but a warning. Whole sections are organized by who you are investigating — People, Resident Database, Public Records, Police / LE / Fed, Informant, Extremist / Far-Right, War / Military Conflict. The far-right shelf holds DDoSecrets, Unicorn Riot’s Discord leaks, ProPublica’s Parler archive and START’s terrorism database next to raw leak dumps and no-fly list mirrors, with no disclaimer of any kind — unlike awesome-social-engineering, which scopes itself to professionals and controlled environments. This is the dual-use tension in its least mediated form: the same shelf equips an investigative journalist and a person building a dossier on someone. Recorded, not resolved.

The counter-census, hours later (awesome-osint-mcp-servers)

soxoj‘s list arrived the same day and counts something else: ~60 MCP servers, every one of them machine-callable, across ten categories that reach as far as the census did (blockchain intelligence, market & trading, public records and compliance sit beside SOCMINT and network scanning). It grades T3 rather than T4 because each row states open-source status, pricing tier and whether an API key is needed — an inclusion standard, applied per entry.

The two lists are not in conflict; they are counting different stages. 1,730 links describe what practitioners use, and it is mostly websites. 60 describe what has been wrapped so an agent can call it. The gap is the size of the conversion still outstanding, and it says the automation frontier is early in tool terms as well as in the AI-section terms the census already showed.

What it does change is where the automation lives. llm-osint built its own loop and kallisto-osinter wired its own instruments in; both had to contain their tooling. MCP standardizes the tool layer underneath, so an OSINT capability can now be published for whichever agent shows up. The ai-osint page has been describing agents that include their instruments — this inverts that relationship, and it is the first source here that documents the interface rather than an implementation.

The dual-use consequence is specific and worth stating plainly: none of these capabilities is new, but composition gets cheap. Username enumeration, breach lookup, network scanning and public records behind one model that picks the order is a different amount of work to assemble a dossier than the same four tools run by hand. Like the census, this list carries no disclaimer. awesome-social-engineering remains the only catalog in the corpus that scopes its own use.

The mirror: same primitives, subject-side

myip is the first source here that runs the toolkit inward. Three things fall out of it.

The attribution layer is a short, shared list. MaxMind GeoLite2, CAIDA, RIPEstat, and a handful of commercial geolocation APIs are what everyone resolves an IP against, offensive or defensive (ip-reconnaissance). So accuracy in this branch is inherited from vendors rather than measured, and querying several at once is the field’s standing hedge against any one being wrong. It also means the capability has no gate: the same free databases serve an investigator, an ad-tech fingerprinter, and a person auditing their own VPN.

Dual-use, minus the ethical charge. The spoke’s dual-use tension is usually about who gets profiled. Here the technique is identical and the target is yourself, which strips the harm out while leaving the capability intact. That makes MyIP a useful reference point for the defensive thread: the honest defensive move against cheap recon is knowing what the cheap recon already sees.

A privacy tool carrying telemetry. MyIP marks a Google Analytics ID required and ships a first-party route for relaying Sentry envelopes past ad blockers. Both are disclosed, and a self-hoster can switch them off. It is still a small standing lesson for this corpus: measuring exposure and reducing it are separate jobs, and a tool that does the first isn’t automatically aligned with the second.

The mirror has an outward face too (2026-08-05, cloakquest3r). MyIP runs the infrastructure toolkit inward; cloakquest3r runs the same primitives outward against a protected target, recovering the origin IP a CDN is paid to hide. It is the spoke’s first tool whose target is a defensive control rather than a subject — and it sharpens the mirror rather than breaking it, because the two describe one move from opposite ends. What CloakQuest3r exploits is not a weakness in Cloudflare but the target’s own leaks: a forgotten unproxied subdomain, a DNS record from before the migration, a re-used TLS certificate. So the defensive reading MyIP implied becomes concrete — the honest defence is running this against your own domain first, and origin exposure is a configuration failure the proxy vendor cannot fix for you.

The counter-side arrives, and it is not clean (mysterium-node)

Growth edge 4 asked for the defensive mirror — privacy hardening or counter-reconnaissance — and the first source on it is a decentralized VPN: peer-to-peer exits over WireGuard, run by whoever wants to rent out a connection, settled on-chain. It does not answer ip-reconnaissance‘s leak surface at all. WebRTC, DNS leaks and fingerprinting are untouched, and myip would still catch every one of them. What it changes is whose address you borrow.

That single change carries the whole ambiguity. Commercial VPN exits sit in datacenter ASNs, which the attribution layer marks and many services block; dVPN exits are residential, which is the hardest category to tell from an ordinary user and the one scraping and fraud operations pay for. So the corpus’s first counter-reconnaissance tool is simultaneously a supply of the resource that makes automated abuse work. The dual-use stance this spoke keeps applying to gathering tools now applies to a defensive one, and in the same shape: identical mechanism, different party.

The second half is sharper and is not about dual use. The exit operator inherits the attribution. Other people’s traffic leaves from their prefix, so MaxMind’s geolocation, CAIDA’s org mapping and RIPEstat’s announcement history all resolve to them. Privacy for the person routing through is paid for by someone who volunteered to be the answer to the lookup — a redistribution of exposure rather than a reduction of it. Everything this spoke has written about attribution being cheap and public applies unchanged; only the person on the receiving end has moved. And the incentive design that decides who accepts that trade is exactly what the repository does not document.

A third axis: distribution (termux-commands-site)

The corpus has sorted itself by autonomy (how much of the analyst’s loop a tool absorbs) and by object (person ↔ machine secrets). A tutorial site for termux adds an axis neither covers: who can run this, on what.

143 install-and-run guides, two thirds of them reconnaissance and offensive security, 29 in the OSINT category alone — all written for a phone with no root and no computer behind it. The tools are the same public Python repos this spoke reads directly; the site verifies nothing and adds nothing but five lines of pkg install. That is precisely the point. Every source here so far has described a capability getting smarter: llm-osint automating the analyst, kallisto-osinter orchestrating agents, strix running the whole chain. This one describes the same capabilities getting closer to hand while staying exactly as smart as they were, and it has been doing it since 2023 with no AI involved.

Both directions lower the same cost. strix noted a cost floor — local models instead of a metered key — as the striking detail of autonomous pentesting; the floor under that is a mid-range Android phone and a free app. The autonomy axis measures how little skill the operator needs; this measures how little equipment they need, and the two are independent. A tool can be crude, manual and decades old and still represent an expansion in reach if the population able to run it grows by an order of magnitude.

Two qualifications keep this honest. The platform selects for a narrow slice of the field — API-and-HTTP-shaped recon, because no root means no packet capture — so the phone kit is username sweeps, IP and phone lookups and scraping, not the heavy half of offensive security. And the site is T4: good evidence of its own existence, taxonomy and audience, weak evidence about any tool it describes.

The username-reconnaissance page is the technique that catalog is thickest on, and it closes the thread gitsint opened — the handle sweep is the breadth-first sibling of GitSint’s depth-first email pivot. Its AI angle is instructive about where models actually enter a mature technique: Aliens_eye advertises an AI confidence score on results, not AI enumeration. The request loop needs no intelligence; deciding whether a hit is the right person does. That is the analyst’s judgment step being absorbed while the mechanical part stays mechanical — the thesis in miniature, though advertised rather than demonstrated.

The defensive read of the whole axis. Defences calibrated against a professional adversary — detecting an analyst, an agent, a datacenter — miss this entirely. There is no signature to catch: a username sweep is a few hundred ordinary GETs from a residential mobile IP, and no single site sees anything worth logging. The exposure a person should assume is the exposure to anyone with a phone, which is the same conclusion myip reached from the subject side and is now true of the identity branch as well.

A third object: place and event (ironsight)

The object axis had two values — the person (llm-osint, gitsint) and the machine or attack surface (swaggerspy, ip-reconnaissance). ironsight adds a third that behaves differently from both: a place, while something is happening in it (conflict-monitoring).

The difference is that the subject cannot be enumerated. Everything else in this corpus works by querying an index — a handle against profile URLs, an address against WHOIS and ASN records — and finishes when the queries are exhausted. A war has no index and no finish. What replaces enumeration is continuous aggregation: a dozen partial, contradictory feeds sampled on their own clocks, with correlation left to whoever is watching. IRONSIGHT is that literally — sirens polled every 15 seconds, markets every 10 minutes, all of it drawn on one map, none of it reconciled.

Three consequences follow.

The autonomy axis runs backwards here. This spoke’s trajectory has been manual → single-LLM → multi-agent, with the analyst progressively removed. IRONSIGHT has no model in it at all except an unreviewed machine translation, and it draws no conclusion of any kind. It sits behind the manual toolkit: not automating the analyst’s judgment, but widening what one pair of eyes can hold at once. The pole kafsiem occupies — analyst-in-the-loop fusion — turns out to have two very different inhabitants, one building an auditable entity graph and one building a wall of panels. Both keep the human; only one leaves a trace of why anything is on screen.

Capability follows other people’s sensors. Person-recon exploits infrastructure built to publish people. Conflict monitoring exploits infrastructure built for something else entirely — public warning sirens, air-traffic transponders, wildfire satellites — and so its reach is set by whatever happens to exist in a given place. IRONSIGHT’s two theatres are not symmetric for this reason: Ukraine has a community drone-track feed, Israel has a national siren API, and neither has the other’s.

Source contamination stops being a hypothetical. osint-overview-wikipedia named deliberate poisoning as OSINT’s structural weakness and this corpus has treated it as a risk to guard against. IRONSIGHT’s feed list puts TASS, RT and PressTV in the same undifferentiated stream as Reuters, Meduza and the Kyiv Independent, plus scraped Telegram channels, with no reliability marking on anything. An analyst may well want exactly that — knowing what each side is claiming is the job. But the interface makes no distinction available, which converts a known input-integrity problem into a design decision, and one the project does not discuss. It is the clearest instance yet that this spoke’s two risk axes are not equally attended to: the privacy axis gets disclaimers, the source- integrity axis gets a feed list.

There is also a standard here that most of the corpus lacks. The berkeley-protocol was written for this exact material, and it centres on verification, preservation and chain of custody. IRONSIGHT keeps nothing — it is a live view with no archive — so the gap between the practice and the tool is measurable for once, and the tool loses.

The standard is not “keep a human in the loop” (quality cycle, 2026-08-10)

The berkeley-protocol page has been asserting a summary of a document nobody here had read. The full text was extracted this cycle, and the coarse reading — the standard requires an analyst in the loop — turns out to be wrong in a useful direction. The Protocol permits automation outright: “either manual or automatic methods can be used.” What it imposes instead is three specific tests, and this spoke’s tools fail different ones.

Explainability (¶25). Automated processes “must be understood by users and be explainable in court either by users or developers.” That is not a preference for humans; it is a disqualification of methods whose output cannot be reconstructed. An LLM profiler whose method is a prompt fails it while a documented scraper passes.

Data minimization (¶31). Collect only what is justified, necessary and proportional — which the Protocol says in terms “favours itemized, manual collection over bulk, automated collection.” The collect-everything-then-cluster shape (kallisto-osinter) is the named anti-pattern, and the stated harms are not only privacy: over-collection means investigators stop knowing what they hold.

Preservation (¶32). The duty against under-collection, and the one no tool in this corpus implements. Platforms delete, users edit, links rot; without a timely preservation request or an independent capture, material is gone. ironsight plots feeds and keeps nothing. Everything else here fetches and summarizes. kafsiem‘s per-edge provenance is the corpus’s only feature that answers a Protocol requirement directly.

So the tension this spoke has been recording between the standard and the automation is sharper than “oversight versus throughput” (growth edge 3). The Protocol’s axes are professional, legal and ethical; it never scores coverage, recall or speed. A tool that finds more, faster, earns nothing under it. The open question is now narrower and testable: which automated collectors could survive ¶25 in court, and nobody has run that test.

One methodological precision worth keeping corpus-wide: the Protocol insists on “first copy found online” rather than “first copy online,” because closed channels may have carried an item before it surfaced publicly. Attribution is often impossible and is explicitly not required for authentication.

Growth edges

Ranked; each names the kind of source that would close it (see ../QUALITY.md → Growth edges).

1. First T1 — CLOSED 2026-08-07 by the research pass, twice over: the Berkeley Protocol (OHCHR/UC Berkeley, T1) and the CSIR ECCWS 2026 study (peer-reviewed, T1). The spoke’s floor goes from T1 0 to T1 2.
2. Measurement of the AI-automation claims — the collection half. Partly closed 2026-08-07: the ECCWS study measures eight LLMs on analysing supplied evidence. What no source measures is autonomous gathering — whether llm-osint or kallisto-osinter find the right things in the first place, and what they miss. — needs: a T1/T2 evaluation of an autonomous collector against known ground truth · hunted 2026-08-08 — nothing ≥ bar. Three benchmarks read and all three score the wrong stage: PolyGnosis 2.0 grades reasoning over a fixed alert feed, Wiki Live Challenge grades the written report against Wikipedia Good Articles, ResearchClawBench supplies the literature and hides only the target paper. Agent evaluation has settled on scoring outputs, and an evaluation of collection needs something this field does not build: a target whose full evidence set is known in advance. Not re-hunted before 2026-08-22.
3. What oversight costs. New 2026-08-07. Both new T1s conclude “keep the analyst in the loop,” and neither says what that does to the throughput the automation was for. — needs: any study or field report pairing an accuracy figure with an analyst-time figure.
4. The Protocol’s actual requirements. CLOSED 2026-08-10. The 102-page text was extracted with pypdf (the earlier “no poppler” note was wrong) and berkeley-protocol now carries the fourteen principles, the chapter structure, and the source/technical/content analysis split. Successor edge: what the Protocol’s explainability requirement disqualifies — no source here tests an automated collector against ¶25’s “explainable in court” bar.
5. Hosted services, sourced properly. awesome-osint-list establishes that the field’s modal tool is a website, not a repo, and the corpus holds none of them as a subject. — needs: a T2/T3 source on a major hosted platform (a breach-search or people-search service) covering what it holds, where it gets it, and what it logs about the searcher.
6. The defensive/counter-OSINT side is absent — the mirror of defensive-security-wiki’s stance. — needs: T1/T2 on privacy hardening or counter-reconnaissance.

Coverage edges (added 2026-08-08, at the curator’s request for a wider backlog). These widen what the spoke covers instead of answering an open question above; one ordinary solid source closes any.

7. Geolocation and chronolocation. The craft skill at the centre of open-source investigation — shadows, terrain, signage, satellite comparison — has no page. — needs: a published methodology or a documented case with its reasoning shown. Sharpened 2026-08-10: ironsight opened conflict-monitoring with a tool that plots coordinates supplied by feeds and verifies none of them, so the spoke now covers the aggregation half of this discipline and none of the craft half.
8. Preservation and archival. New 2026-08-10. berkeley-protocol‘s centre of gravity is keeping open-source evidence usable later — chain of custody, hashing, provenance — and the corpus’s only conflict-monitoring tool deliberately keeps nothing. — needs: a source on an evidence-archiving practice or platform (a war-crimes documentation project, an archival toolchain), not another live viewer.
9. The infrastructure search engines. ip-reconnaissance describes the activity; Shodan, Censys and ZoomEye, the tools that do it, are absent. — needs: their own documentation plus one research use with figures.
10. The practicing institution. Bellingcat publishes both investigations and the method behind them, and the spoke argues about verification standards without holding either. — needs: their published methodology, alongside berkeley-protocol.
11. Media verification. Reverse image search, provenance signing (C2PA) and synthetic-media detection are the counter-side of a corpus that assumes evidence is genuine. — needs: the C2PA specification plus a detection study with error rates.

Contradictions / tensions

No internal fact conflicts yet (the three founding sources are complementary — two tools + a resource base). The standing tension is external and ethical: capability vs. privacy/consent, addressed in the dual-use section above rather than as a source disagreement.

Cross-spoke adjacency

• ../agentic-tooling-wiki — owns the agent machinery (LLM orchestration, web-search tools, map-reduce). ai-osint is its application to intelligence-gathering: filed here by subject, cross-linked there by mechanism (cf. the parked agentic-tooling rule, tools vs. their application).
• ../ai-governance-wiki — owns privacy/surveillance policy & regulation; this spoke owns the tools/techniques. The ethics framing here cross-links the governance there.
• ../dev-tooling-wiki — owns termux as a Linux environment (the APT port, the toolchain, the package repo). Filed here by dominant substance because two thirds of termux-commands-site‘s catalog is recon; the platform-as-toolchain angle belongs there. Runner-up on the 2026-08-03 route.

Index — OSINT Wiki

Catalog of every page, grouped by schema.org @type. Spine: synthesis (thesis), log.md (history), this file (catalog). Spun out of the hub _inbox security/OSINT cluster on 2026-06-30 (3 sources). Dual-use: documented for defense/education/research — see the ethics stance in synthesis and CLAUDE.md.

DefinedTerm (concepts / disciplines)

• osint — umbrella: gathering/analyzing public information for intelligence; the reconnaissance discipline + its classic toolkit · discipline
• ai-osint — LLM/agents automating OSINT; the single-LLM → multi-agent autonomy axis; the spoke’s leading edge · pattern
• social-engineering — attacking the human element; OSINT is its reconnaissance phase · discipline
• autonomous-pentesting — LLM agents running the whole offensive chain (recon → exploit → post-exploit) and validating findings by making them work; recon demotes to a subroutine; authorization is the only boundary and it’s prose · practice
• username-reconnaissance — the identity branch: one handle checked against hundreds of profile URLs, then correlated; breadth-first sibling of gitsint‘s email pivot, false positives structural, AI entering as a confidence score rather than as enumeration · technique
• conflict-monitoring — the place-and-event branch: watching an active conflict through repurposed public sensor networks (sirens, ADS-B, thermal satellite) and news/social feeds; the subject can’t be enumerated, so continuous aggregation replaces the query, and contamination — not privacy — is the primary risk · practice
• ip-reconnaissance — the infrastructure branch: address → ASN/org/geo/WHOIS/upstream; the shared attribution datasets (MaxMind, CAIDA, RIPEstat), the three leaks a VPN doesn’t close, and the inward/outward pair (myip self-audit ↔ cloakquest3r origin-hunt) · technique

Report (standards / sources)

• berkeley-protocol — OHCHR + UC Berkeley Human Rights Center; international standards for digital open source investigation — methodology, preservation, and the professional / legal / ethical axes, plus investigator digital-physical-psychosocial safety; the spoke’s first standard and first T1 · source · T1 · ohchr.org

ScholarlyArticle (sources)

• llm-osint-reliability-study — Baloyi et al. (CSIR), ECCWS 2026: eight LLMs scored against a fabricated organization on accuracy, attribution, traceability and hallucination; finds forced narrative construction under adversarial prompting and argues for human oversight + multi-model validation; the spoke’s first measurement · source · T1 · doi.org/10.34190/eccws.25.1.4818

Article (sources)

• osint-overview-wikipedia — encyclopedic overview of the discipline: definition, IC history (Open Source Center 2005, OSINT Foundation 2022), the six source categories, the OSINT Framework, and the disinformation/source-contamination risk; the spoke’s neutral anchor · source · T2 · en.wikipedia.org

SoftwareSourceCode (tools / sources)

• llm-osint — sshh12’s PoC: LLM + web search autonomously profiles public figures; the single-LLM pole (founding seed) · source · T3 · github.com/sshh12

• kallisto-osinter — avrtt’s multi-agent LLM OSINT: search/orchestration/deep-dive agents + map-reduce; the orchestrated pole · source · T3 · github.com/avrtt

• kafsiem — Scalytics’s entity-graph platform: fuses OSINT + operational/OT data into an auditable, provenance-tracked graph for analysts; the defensive / fusion pole (air-gapped defense, SCADA) · source · T3 · github.com/scalytics

• swaggerspy — UndeadSec’s regex scanner for secrets exposed in SwaggerHub API docs; the spoke’s first secrets-recon / attack-surface tool (non-AI, single-platform) · source · T3 · github.com/UndeadSec

• gitsint — N0rz3’s GitHub OSINT profiler (non-AI, single-platform, async, GPL-3.0); user/email/org enumeration + commit-history email harvesting; the classic-mode person-profiler and the email ↔ identity pivot · source · T3 · github.com/N0rz3

• strix — usestrix’s autonomous AI pentesting agent (Apache 2.0, ~44.8k★, strix-agent on PyPI): a “Graph of Agents” for recon/exploitation/post-exploitation with Caido proxy, Playwright, shell and a PoC sandbox; CI-gated red teaming, exploit-validated findings, mid-run steering; the spoke’s first tool whose agents act on the target · source · T3 · github.com/usestrix

• myip — jason5ng32’s self-hostable IP toolbox (MIT, ~11.3k★, demo ipcheck.ing): IP/ASN/geo/WHOIS/MTR/DNS + WebRTC & DNS-leak & fingerprint tests + censorship and proxy-rule checks; the spoke’s first subject-side tool · source · T3 · github.com/jason5ng32

• mysterium-node — decentralized VPN node software (Go, GPL-3.0, 1.3k★, WireGuard, Pi/BalenaOS targets, Ethereum settlement): the spoke’s first counter-reconnaissance infrastructure — it changes whose address you inherit, not the leak surface ip-reconnaissance names; exits are residential, so the same design serves privacy and supplies the residential-exit pool behind automated abuse, and the operator inherits the attribution for other people’s traffic. Payout mechanics undocumented · source · T3 · github.com/mysteriumnetwork

• cloakquest3r — spyboy-productions’ Cloudflare origin-IP discovery tool (MIT, ~2.2k★): subdomain + SSL-cert + IP-history recon to defeat CDN origin-hiding; non-AI, the spoke’s first tool aimed at a defensive control rather than a subject — myip‘s inward mirror run outward · source · T3 · github.com/spyboy-productions

• ironsight — Nobler Works’ two-theatre conflict-monitoring dashboard (MIT, ~564★, Next.js 16 + Leaflet): ~12 keyless public feeds — Google News, scraped+translated Telegram, adsb.lol, Israeli/Ukrainian siren APIs, drone tracks, NASA FIRMS, markets — polled on tiered clocks onto one map. No AI, no conclusion, no archive; state media sits unmarked beside wire services. The spoke’s first tool whose subject is a place, and its first admitted-grey-area sourcing (undocumented endpoints, possible ToS violation, liability pushed to the user) · source · T3 · github.com/NoblerWorks-HQ

SoftwareApplication (platforms)

• termux — the Android terminal + Debian-style APT userland the phone recon kit runs on; no root, F-Droid/GitHub distribution; matters here for what it removes (desktop, VM, sysadmin skill) and for the API-and-HTTP-shaped recon its constraints select for · platform

WebSite (sources)

• termux-commands-site — Achik Ahmed’s 143-post install-guide site (live since 2023-09-25); two thirds of the catalog is recon/offensive security, 29 posts in OSINT alone; evidence of a distribution channel and audience, not of any tool it describes · source · T4 · termuxcommands.com

Collection (sources)

• awesome-osint-list — Astrosp’s single-file census of the toolkit: ~1,730 links / ~90 sections (GPL-3.0, ~4.1k★). Shows the field is mostly hosted web services, not repos; organizes by who you investigate (People, Public Records, Extremist/Far-Right, War, Police/LE) as much as by technique; its “AI” section is mostly AI as target (LLM security/red-teaming), not AI-for-OSINT; a whole bug-bounty wing. No disclaimer, no criteria, no dates · source · T4 · github.com/Astrosp
• awesome-osint-mcp-servers — soxoj’s list of ~60 MCP servers for OSINT across 10 categories (SOCMINT, network, scraping, company, public records, threat intel, research, meta/discovery, blockchain, market): the tool layer standardized for agents, where llm-osint and kallisto-osinter each wired their own instruments in. Marks open-source/pricing/API-key per row — an inclusion standard awesome-osint-list lacks, hence T3 not T4 · source · T3 · github.com/soxoj
• awesome-social-engineering — giuliacassara’s curated social-engineering / OSINT / phishing resource list; the human-element + manual-recon baseline · source · T4 · github.com/giuliacassara

Organization (entities)

• nobler-works — the shop behind ironsight; gives the artifact away entirely (MIT) and sells building another one — a lighter commercial pattern than usestrix‘s open core · entity
• usestrix — the company behind strix; open-core (Apache-2.0 CLI, hosted platform) selling compliance-ready pentest reports (SOC 2 / ISO 27001 / PCI DSS); the spoke’s first commercial vendor · entity

Person (entities)

• astrosp — maintainer of awesome-osint-list; no stated affiliation, credentials or inclusion policy — the absence is part of the list’s T4 grade · entity
• soxoj — maintainer of awesome-osint-mcp-servers; no stated affiliation either, but the per-row open-source/pricing/API-key marking is a visible inclusion standard · entity

Synthesis

• synthesis — the thesis: OSINT is reconnaissance, LLMs are automating the analyst out of the loop; OSINT + social engineering are one chain; the dual-use tension

Notes

• Author/curator entity nodes (sshh12, avrtt, giuliacassara, UndeadSec/Alisson Moretto, N0rz3, jason5ng32, Achik Ahmed) deferred — thin one-off creators at founding; page them when one recurs or a query needs it. (UndeadSec is a recurring offensive-security tool author — first to watch for a recurrence. mxrch/GitFive noted as GitSint’s inspiration but not paged.) First exception 2026-08-05: astrosp is paged because the curator’s invisibility — no criteria, no affiliation — is itself a claim the awesome-osint-list page rests on.