Skip to content
osint.platform

Data sources

Every finding in this platform names the source it came from. This page lists all of them. The core platform runs entirely on free, public sources, paid providers are optional enrichment, and when one is not configured the investigation continues on everything else and records why that source was skipped.

Free public sources

No API key, no account, no cost. These run on every applicable investigation.

ProviderSourceCategoryApplies to
DNS Recordsdns.cloudflarednsdomain, subdomain, email, url
Email Authenticationdns.cloudflarednsdomain, subdomain, email, url
Domain Registration (RDAP)rdap.orginfrastructuredomain, subdomain, email, url
Email Analysisdisposable.listidentityemail
IP Intelligencerdap.orginfrastructureip, domain, subdomain, url
Certificate Transparencycrtshcertificatesdomain, subdomain, email, url, organization
Live TLS Certificatetls.handshakecertificatesdomain, subdomain, url, email
Web Intelligencehttp.probeweburl, domain, subdomain
Username Intelligenceusername.probeprofilesusername, email
Threat Intelligencespamhaus.dnsblthreatip, domain, subdomain, url, email
GitHubgithub.publicrepositoriesusername, email, organization
Wayback Machinewaybackarchivesdomain, subdomain, url

Optional paid sources

These require an API key set by the operator. They are never required: an investigation with no keys configured still runs every free module, and the workspace shows the skipped source and the reason rather than silently omitting it.

  • Breach Exposure (HIBP)API key required
    hibp
  • Google Safe BrowsingAPI key required
    safebrowsing

Platforms checked for usernames

30 platforms, all of which publish profile pages that can be read without an account.

GitHubGitLabCodebergSourceHutnpmPyPIDocker HubStack ExchangeMediumDEV CommunityHashnodeSubstackWordPress.comRedditHacker NewsLobstersMastodon (mastodon.social)BlueskyTelegramSteamitch.ioChess.comLichessBehanceDribbbleSoundCloudFlickrKeybaseGravatarabout.me

Platforms deliberately excluded

Checking these would require authenticating, defeating an anti-bot challenge, or otherwise circumventing an access control. They are excluded by policy, and the exclusion is reported in every username investigation so the coverage gap is explicit.

  • Facebook

    Profiles require authentication to view; probing would mean bypassing an access control.

  • Instagram

    Public profile access is gated behind login walls and anti-automation challenges.

  • LinkedIn

    Profile access requires authentication and the terms prohibit automated retrieval.

  • X / Twitter

    Public profile reads now require authentication.

  • TikTok

    Profile pages are served behind an anti-bot challenge.

  • Snapchat

    No public profile surface to observe.