osint-profile

OSINT Profile

Structured identity verification for inbound people, companies, and agents. You feed it a name, a company, and whatever URLs you have; it returns a sourced verdict you can act on.

Built on the public tool taxonomy from IntelTechniques (Michael Bazzell & Jason Edison, OSINT Techniques, 11th Edition) — see references/osint-tool-catalog.md. This skill automates the subset that machines do well and points you at the manual tools for the rest.

When to use

• An unknown person DMs / cold-emails you with a pitch, offer, or "let's collaborate."
• An autonomous agent or bot interacts with your repo / inbox / site and you want to know who runs it.
• Before you reply warmly, hire, sign, invest, endorse, or quote someone.
• Someone's claimed credentials, scale, or track record feel inflated and you want ground truth.

Authorized-use guardrail (read first)

This is defensive verification of an entity that has engaged with you or that you are evaluating, using only public sources. It is not for surveillance, stalking, harassment, or building dossiers on private individuals who haven't entered a transaction with you. Don't:

• pursue minors, or non-public private individuals with no business nexus to you;
• use breach/leak data to access accounts (read for existence/recency signals only, never to log in);
• publish the raw findings naming a private person (anonymize the person, name the pattern — see "Reporting").

If the target is a public company, a public-facing founder, or an agent pitching you commercially, you're on solid ground.

The investigation (run in order; later phases are cheap once earlier ones narrow the target)

Create a todo per phase. Record every finding with its source so the verdict is auditable. Never assert a negative from one empty check — verify authoritatively or hedge.

Phase 1 — Domains (free, fast, high-signal)

For every domain they own or reference (the company site, sibling brands, any backend host):

whois example.com | grep -iE "creation date|registrar:|registrant|name server"
dig +short example.com A; dig +short example.com NS; dig +short example.com MX
curl -sI https://example.com/ | grep -iE "server|cf-ray|x-powered|via"   # host/stack fingerprint

Read for: registration date (a "20-year company" on an 18-month-old domain is a tell), privacy-shield vs real registrant, shared nameservers/registrar across "separate" brands (→ one operator wearing many hats), and the real backend host (Heroku/Vercel/etc.) behind a marketing front.