# Osint

> Passive OSINT reconnaissance on domains, IPs, organizations

- Skill: `majiayu000/osint-3` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/osint-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/osint-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/osint-3

---


# OSINT Reconnaissance

Passive intelligence gathering:
- Domain WHOIS and DNS records
- Subdomain enumeration
- IP geolocation and ASN lookup
- Certificate transparency
- Email format discovery
- GitHub/code leak search
- Social media reconnaissance

## Required Context
1. **Target**: Domain, IP, organization, or individual
2. **Scope**: What to focus on (infra, emails, leaks)
3. **Output**: Format preference

## Tools Used
whois, dig, subfinder, amass, shodan, geoiplookup, theHarvester, crt.sh

## Example
```
/osint
Target: example.com
Focus: Infrastructure mapping, email format
```