OSINT (open-source intelligence)

Open-source intelligence (OSINT) is the practice of gathering and analyzing publicly available information — web pages, social media, registries, DNS/IP records, leaked datasets, public documents — to produce intelligence about a person, organization, or system. It is the reconnaissance discipline at the root of this spoke: the input-collection phase that both investigators and attackers depend on.

An old institutional practice

OSINT is not new; the AI tooling is. Press-monitoring practices date to the 19th century, and the modern US intelligence line runs from the 1941 Foreign Broadcast Monitoring Service to the Open Source Center (stood up in 2005 on a 9/11 Commission recommendation), with the OSINT Foundation (2022) professionalizing it inside the Intelligence Community osint-overview-wikipedia. The publicly available information it works over spans six streams — media, internet/social, government data, academic and professional literature, commercial (e.g. satellite imagery, financial data), and grey literature (reports, patents). What the AI shift changes is the speed and cost of running this old cycle, not its definition.

The classic toolkit

Done manually, OSINT runs on a well-known stack the field has built over years — Maltego (link analysis), theHarvester (emails/subdomains), Shodan (internet-exposed devices), Spiderfoot and recon-ng (automation frameworks) — catalogued in awesome-social-engineering. Each automates one slice of finding and correlating public data. That “one narrow slice” pattern is still alive outside the AI wave: swaggerspy scans a single platform (SwaggerHub API docs) with regexes for exposed secrets — no LLM, just automating a specific recon task against a specific public corpus.

What the AI shift changes

The spoke’s thesis is that LLMs are absorbing the analyst’s loop: instead of an operator running tools and stitching results, an AI-OSINT system queries the web, reads results, and assembles the profile itself (llm-osint), or distributes that across specialized agents for deeper investigation (kallisto-osinter). The manual recon stack becomes the substrate the agents drive.

The infrastructure branch

Alongside people-profiling sits IP and network recon — resolving an address to its ASN, org, geolocation, WHOIS record and upstream topology. Shodan and recon-ng in the classic stack above work this seam. It runs on a small set of shared datasets (MaxMind GeoLite2, CAIDA, RIPEstat, commercial geo APIs), which makes the capability cheap, public, and equally available to whoever points it at you and to you pointing it at yourself (myip).

The identity branch

The counterpart to the infrastructure branch is username and identity recon — one handle checked against hundreds of profile URLs, then correlated. Same move as an IP lookup (cheap identifier in, person out), but the identifier is self-chosen and reused for years, which makes it the more durable link. gitsint‘s email harvesting is the deep version of the same seam.

Recon as phase one (autonomous-pentesting)

Everything above treats reconnaissance as the deliverable. strix treats it as a subroutine: its recon agent maps the attack surface so its exploitation agents have somewhere to start. Seen from there, osint is the opening move of a chain that now runs end to end without an operator, which is the widest the spoke’s subject has stretched — from gathering public information to acting on what it reveals.

Where it sits

OSINT is the reconnaissance phase of social-engineering: knowing a target’s habits, contacts, and context is what makes a pretext credible. So this spoke’s two halves — automated OSINT tooling and the social-engineering human element — meet here: OSINT is what feeds the attack (or the defense).

It cuts both ways. The same public-data gathering feeds defensive work too: kafsiem treats OSINT as one input fused into an auditable entity graph an analyst uses to defend critical infrastructure. So OSINT is the shared substrate of both offensive recon and defensive threat-intelligence (ai-osint automates the gathering; a fusion graph reasons over it).

Ethics

OSINT uses only public data, which makes it feel benign, but aggregating public fragments into a profile is precisely where privacy harm and surveillance risk concentrate — sharpened when automation makes it cheap and scalable. See synthesis for the spoke’s dual-use stance.

ai-osint · social-engineering · ip-reconnaissance · username-reconnaissance · autonomous-pentesting · llm-osint · kallisto-osinter · strix · myip · awesome-social-engineering · synthesis