Imbutus
← Documentation

OSINT workflows

Send "osint" in your chat and the model replies with these workflows and their exact syntax — no need to memorize anything.

  • osint:email <address>

    Builds a full picture of an email address — where it is registered, the identity behind it, and where it appears online — without ever alerting the owner.

    whoisdigholehegravatarGitHubDuckDuckGowebfetch

    How it works

    1. Whois on the domain of the address for the registrar and registration date — skipped automatically for public webmail (Gmail, Outlook, Proton, Yandex and the like), where the domain describes the provider, not the person.
    2. Reads the MX records to identify the mail provider actually handling the inbox (Google Workspace, Proton, a company mail server and so on).
    3. Runs holehe, which silently checks about 120 sites (GitHub, Instagram, Spotify, Patreon, Office365 and more) for whether the address has an account there — no login attempt and no notification to the owner. Each site comes back as registered, not registered, or rate-limited and inconclusive; inconclusive results are flagged, never guessed.
    4. Looks up Gravatar by the email hash — often the fastest identity hit: a public avatar plus a profile with a real name, username, location, job and linked accounts.
    5. Maps the email to a GitHub account through commit search, since developers leak their address in commit metadata; a GitHub noreply address is decoded to its username directly.
    6. Searches the web for the exact address and, on the pages where it appears, extracts the other contacts the same poster left beside it — nicknames, other emails, phone numbers, social links — as candidates with source links.
    7. Brings the accounts, identity and candidates together in one report, and never invents a result the tools did not return.
  • osint:person <name>

    Finds the public profiles and accounts tied to a name across the web.

    maigrettheHarvester

    How it works

    1. Turns the name into likely usernames (firstname.lastname, firstnamelastname and similar), transliterating non-Latin names and also searching the native script where that is more accurate.
    2. Runs maigret on those handles — it checks about 3000 sites and, unlike a plain existence check, pulls profile data from each hit: real name, bio, avatar, location and linked accounts.
    3. Queries GitHub for accounts matching the name, and can pull a candidate profile plus the emails that account has committed with.
    4. Runs theHarvester for extra context when an organization is also given.
    5. Reports the profiles found with an explicit name-collision caveat — a match is never asserted as certainly the right person.
  • osint:company <name>

    Resolves a company name to its real infrastructure and the people behind it.

    theHarvesterwhoiscrt.shdig

    How it works

    1. Confirms the official company domain first, so every later lookup targets the real website.
    2. Runs the full Domain workflow against that domain — whois, subdomain enumeration, DNS and live-host fingerprinting.
    3. Runs theHarvester to surface employee names and emails and the likely corporate email pattern.
    4. Reports the confirmed domain, org structure, key people, email pattern and infrastructure findings together.
  • osint:domain <domain>

    Maps a domain end to end — who owns it, its subdomains, which hosts are live and what they run, its DNS, and its history.

    whoissubfinderamasscrt.shhttpxwhatwebwafw00fdigtheHarvester

    How it works

    1. Whois for the registrar and creation date, reported only when whois returns it.
    2. Enumerates subdomains from several independent sources — subfinder and amass passively, plus certificate-transparency logs (crt.sh) — and merges them into one de-duplicated list.
    3. Probes which of those subdomains are live with httpx (page title, detected technologies, status code), fingerprints each tech stack with whatweb, and detects any Web Application Firewall (Cloudflare, Akamai, Imperva and the like) with wafw00f.
    4. Pulls DNS records (A, MX, NS, TXT) and historical URLs for the domain from the Wayback Machine.
    5. Runs theHarvester for any extra emails and hosts, and reports only what the tools actually returned — no invented subdomains or technologies.
  • osint:mentions <email|name|handle|phone>

    Finds the web pages that mention a target — email, name, handle or phone — and pulls the contacts posted alongside it.

    DuckDuckGowebfetchmaigret

    How it works

    1. Searches the exact target on DuckDuckGo to collect the pages where it appears.
    2. Fetches the top results with a headless browser (Playwright with a stealth plugin), which reads pages behind Cloudflare or rendered with JavaScript that a plain request cannot.
    3. On each page where the target actually appears, extracts the same poster co-located contacts — nickname, other emails, phone numbers, social and profile links — without pulling in unrelated people from the rest of the page.
    4. Reports them as candidates with source links, flagging that a page mentioning the target may still belong to someone else.
  • osint:phone <number>

    Profiles a phone number and finds where it appears online.

    phoneinfogaDuckDuckGowebfetch

    How it works

    1. Runs phoneinfoga to derive the country and region, carrier, and line type (mobile, landline or VoIP) from the number format.
    2. Searches the web for the exact number and fetches the pages it appears on with the headless browser.
    3. Extracts any name, handle or email posted alongside the number, as candidates with source links.
    4. Reports only what the tools returned — carrier and region are facts about the number, not its owner, and a number on a page does not prove ownership.
  • osint:username <handle>

    Investigates one exact username across the web and ties it to a GitHub identity.

    maigretGitHub

    How it works

    1. Runs maigret on the exact handle across about 3000 sites, pulling profile data (name, bio, avatar, location, linked accounts) from every hit.
    2. Looks the handle up on GitHub for its profile and any emails the account leaked in public commits.
    3. Reports the accounts found, with the caveat that the same handle on different sites is not always the same person.

Each workflow needs an active Kali Linux machine — all the tooling (theHarvester, maigret, whois, holehe, and more) is pre-installed on it, so the model can run everything live. Rent one in the Virtual Machines section.

Have more than one machine? Add --machine <name> (or -m <name>) to the end of any workflow — e.g. osint:domain example.com --machine kali-osint — to pin every command to that machine. Without it, your active machine is used.

Every OSINT run saves its full report to a file on your Kali machine (under /root/osint/) and the reply gives you the exact path — download it from the machine card on the home page, or fetch it over SSH with your key.