Fast, Bounded OSINT
for Domains & Usernames.

Hunt down social accounts across 56+ networks concurrently, route scans through OpSec proxies, export reports to CSV or JSON, and audit public domain infrastructure in seconds.

Installation

Choose the installation method that fits your workflow. Because osint-toolkit has zero external dependencies, it works out-of-the-box on macOS, Linux, and Windows.

# 1. Clone the repository
git clone https://github.com/DrowLink/osint-toolkit.git
cd osint-toolkit

# 2. Run directly
./osint torvalds

Quickstart

osint-toolkit automatically detects whether your target is a username or a domain, and renders a clean, hacker-style UTF-8 terminal interface by default.

1. Search a Username (Sherlock Mode)

Simply pass any handle or username. It checks 56+ verified platforms simultaneously:

./osint torvalds

2. Analyze a Domain Infrastructure

Pass any domain to audit DNS records, mail spoofing protection, WHOIS dates, and TLS certificates:

./osint github.com

Username Hunting Engine

Built as an ultra-fast, zero-dependency alternative to Sherlock. It checks platforms concurrently using a thread pool of 20 workers, typically finishing in 2–3 seconds.

Platform Directory (56 Verified Sites)

Filter platforms currently queried by the engine across 5 major categories:

OpSec Proxy & Anonymity Support

Investigators and red teams requiring stealth and rate-limit avoidance can route all outbound reconnaissance through an HTTP or HTTPS proxy (including Tor bridges and corporate proxies).

# Route username hunting through a local proxy
./osint torvalds --proxy http://127.0.0.1:8080

# Use Tor SOCKS / HTTP wrapper
./osint torvalds -p http://127.0.0.1:9050

# Proxy specialized intelligence lookups
./osint ip2location 8.8.8.8 --proxy http://proxy.corp:3128
./search_shodan 1.1.1.1 -p http://127.0.0.1:8080

Domain Reconnaissance

Gathers structured intelligence about a target domain across multiple layers of network and transport infrastructure:

Email Security & Anti-Spoofing

• MX Identification: Automatically categorizes mail servers (Google Workspace, Microsoft 365, ProtonMail, Mimecast, etc.).
• SPF Evaluation: Inspects SPF mechanism records (v=spf1) and assesses policy strength (-all HardFail vs ~all SoftFail vs insecure +all).
• DMARC Enforcement: Validates DMARC records (v=DMARC1), reporting whether email spoofing is enforced (p=reject / p=quarantine) or inactive (p=none).

Additional Infrastructure Checks

• RDAP / WHOIS: Registrar name, creation date, expiration date, and EPP status flags via official ICANN RDAP endpoints.
• IP Geolocation & ASN: Public IP routing ASN, autonomous system owner, country, and city coordinates.
• TLS Certificate: Issuer, common names, SANs, cipher suite, negotiated protocol (TLSv1.3), expiration date, and SHA-256 fingerprint.
• Security Headers: Audits defensive headers including Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, and cookie security flags (Secure, HttpOnly, SameSite).
• Subdomain Discovery: Queries Certificate Transparency logs (crt.sh) for publicly registered hostnames.

Threat & Intel Services

Specialized intelligence commands and pure Python methods for deep infrastructure profiling and malware reputation analysis:

1. Shodan Host Intelligence (search_shodan)

Query open ports, CPEs, hostnames, and known CVEs. By default, it queries Shodan InternetDB with zero authentication (no API key required), and supports full API keys via SHODAN_API_KEY or --api-key.

# Query by IP (zero-auth InternetDB)
./osint shodan 8.8.8.8

# Query by domain (automatically resolves to public IP)
./search_shodan github.com

# Save to JSON
./osint shodan 8.8.8.8 -o shodan.json

2. IP2Location Geolocation & Proxies (search_ip2location)

Lookup accurate country, city, coordinates, timezone, ASN, autonomous system name, and residential vs. proxy/VPN detection. Operates on the public tier without an API key, or with IP2LOCATION_API_KEY.

# Check geolocation and proxy status
./osint ip2location 8.8.8.8
./search_ip2location 1.1.1.1

3. VirusTotal Threat Analysis (search_virustotal)

Queries VirusTotal v3 API for malware engine verdicts (harmless, malicious, suspicious) and reputation scoring across domains and IP addresses. Requires VIRUSTOTAL_API_KEY.

# Check domain or IP reputation
./osint virustotal google.com
./search_virustotal 8.8.8.8 --api-key <KEY>

4. Censys Host Recon (search_censys)

Inspects host services, protocols, ports, and autonomous systems via Censys Search API v2. Requires CENSYS_API_ID and CENSYS_API_SECRET.

# Check Censys indexed services
./osint censys 8.8.8.8
./search_censys 8.8.8.8 --api-id <ID> --api-secret <SECRET>

Local AI Integration (Ollama)

Harness the power of local Large Language Models (LLMs) via Ollama for automated threat synthesis, cross-platform correlation, and identity profiling — with zero cloud API keys and complete privacy.

Running with AI Synthesis

Pass the --ai (or --ollama) flag to any command to generate an AI Intelligence Briefing:

# Username correlation briefing
./osint torvalds --ai

# Domain infrastructure posture analysis
./osint github.com --ai

# Threat scan with AI risk briefing
./osint shodan 8.8.8.8 --ai

# Custom model and endpoint
./osint torvalds --ai --ai-model mistral --ai-endpoint http://localhost:11434

Output & Options

By default, interactive terminal executions display the formatted ASCII/Unicode card. For pipelines, SIEM ingestion, or spreadsheets, pure JSON and standard RFC 4180 CSV formats are supported.

# Output pure JSON to stdout
./osint torvalds -j

# Output standard CSV to stdout
./osint torvalds --csv

# Save findings directly to CSV or JSON
./osint torvalds -o findings.csv
./osint torvalds -o findings.json

# Pipe JSON into jq for instant filtering
./osint google.com -j | jq '.dns.addresses'

CLI Options Reference

Safety & Resource Limits

• Private Target Rejection: Localhost, loopbacks (127.0.0.1), RFC 1918 private subnets, and non-unicast IPs are rejected immediately.
• Memory Protection: All response streams are bounded to a maximum of 256 KiB to prevent denial-of-service or memory spikes.
• Monotonic Deadlines: Every network operation runs against an absolute monotonic clock (time.monotonic()). Socket operations cannot stall process exit.

Documentation Policy (Specs)

In accordance with our project engineering standards defined in SPECS.md:

When contributing new features:

1. Add corresponding unit tests in tests/ to preserve 100% test coverage.
2. Update the relevant sections in this interactive documentation site (docs/index.html).
3. If adding a new social platform, append it to the Platform Directory table with its category and detection method.
4. Keep the CLI option tables and examples in README.md in sync.

Testing & Verification

Run the comprehensive test suite locally. All 83 unit tests run without requiring any external packages or active Internet connection:

python3 -m unittest discover -s tests -v

Roadmap & Future Milestones

We are actively building the most capable, dependency-free OSINT framework. Here is what is on our horizon:

Contributing & Community

Contributions from the community are warmly welcomed! Help us expand platform coverage, refine threat intelligence heuristics, or optimize network speed.