skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

collecting-open-source-intelligence

Collects OSINT on threat actors and malicious infrastructure using passive reconnaissance tools.

954|172|Updated Mar 13, 2026
Search Tags:#reconnaissance#threat intelligence#osint#maltego#infrastructure mapping#Shodan#spiderfoot
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill collecting-open-source-intelligence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: collecting-open-source-intelligence
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/collecting-open-source-intelligence
Command: npx skills add https://github.com/xalgord/xalgorix --skill collecting-open-source-intelligence

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires shodan.

What problem does it solve?

Security teams need to map threat actor infrastructure and enrich threat intelligence reports without tipping off adversaries or crossing legal boundaries, but manual OSINT collection across dozens of sources is slow and error-prone.

Core Features & Use Cases

  • Passive Infrastructure Mapping: Query passive DNS, WHOIS history, certificate transparency logs (crt.sh), and Shodan to cluster malicious domains, IPs, and ASNs without sending packets to targets.
  • Graph-Based Link Analysis: Use Maltego transforms to pivot from a known malicious domain through registrant emails, shared hosting, and reverse DNS to expand infrastructure attribution.
  • Dark Web and Paste Monitoring: Automate collection from paste sites, breach data, and forums using SpiderFoot modules for leaked credentials and IOCs.
  • Use Case: While investigating a phishing campaign, an analyst starts with one malicious domain, cross-checks Shodan, crt.sh, and passive DNS, then builds a Maltego graph that reveals the actor's broader C2 cluster with confidence-scored IOCs.

Quick Start

Use the collecting-open-source-intelligence skill to map the infrastructure behind the domain evil-domain.com using passive sources only.

Frequently Asked Questions about collecting-open-source-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map threat actor infrastructure with OSINT tools?▼

Start with a known malicious domain, query passive DNS and certificate transparency logs via crt.sh, then search Shodan for related services and ASN clusters. Pivot through registrant emails and shared hosting in Maltego to expand the infrastructure graph.

How to find subdomains using certificate transparency logs?▼

Query crt.sh with a wildcard pattern like %.example.com and parse the JSON name_value fields. This reveals subdomains including staging, VPN, or internal infrastructure exposed through publicly logged SSL certificates, with no API key required.

What is the difference between Maltego and SpiderFoot for OSINT?▼

Maltego provides interactive graph-based link analysis with transforms for domains, IPs, and emails, suited for manual pivoting. SpiderFoot automates collection across 200+ modules covering DNS, breach data, and dark web sources, better for bulk correlation.

Does passive OSINT collection require target authorization?▼

Passive OSINT using public databases, cached data, and search engines is legal without authorization since no packets reach target systems. Active techniques like port scanning or banner grabbing require explicit written authorization from the target.

Why does OSINT attribution produce false positives?▼

Shared hosting, reused Cobalt Strike watermarks, and co-hosted domains create false links between unrelated actors. Verify each pivot against independent sources like VirusTotal or PassiveTotal, record confidence scores, and check data timestamps before attributing.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

ioc-extract

Extract IPs, domains, URLs, emails, and file hashes from text, logs, or URLs.

Community
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
Liberty91LTDLiberty91LTD
15

lookup-otx

Retrieve community pulse context for indicators from AlienVault OTX.

Official
Intermediate
luisgustavooliveiraluisgustavooliveira

Recon

Perform passive and active infrastructure reconnaissance using DNS, WHOIS, and IPInfo.

Community
Advanced