osintkit 0.7.0__tar.gz → 0.9.0__tar.gz

{osintkit-0.7.0 → osintkit-0.9.0}/CHANGELOG.md

@@ -6,6 +6,22 @@ All notable changes are recorded here. The format follows
 
 ## Unreleased
 
+## 0.9.0 — 2026-11-02
+
+### Added
+
+- phone targets with offline libphonenumber metadata (region, carrier, line type, timezones)
+- Bitcoin address targets with balance and transaction history from Blockstream
+- per-section confidence, capped by the number of backing sources
+- `password --offline` against a bundled 10k common-password list, no network
+
+## 0.8.0 — 2026-11-02
+
+### Added
+
+- `watch`: interval re-runs that stay silent unless a diff shows change, with optional desktop
+  notification and bounded cycles
+
 ## 0.7.0 — 2026-11-02
 
 ### Added

{osintkit-0.7.0 → osintkit-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: osintkit
-Version: 0.7.0
+Version: 0.9.0
 Summary: Public-data OSINT aggregator for emails, usernames, domains, and companies
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/osintkit
 Project-URL: Issues, https://github.com/sjdsjadjajdjsa/osintkit/issues
@@ -19,6 +19,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: dnspython>=2.6
 Requires-Dist: httpx>=0.27
+Requires-Dist: phonenumbers>=8.13
 Requires-Dist: pydantic>=2.7
 Requires-Dist: python-whois>=0.9
 Requires-Dist: rich>=13.7
@@ -38,7 +39,7 @@ Description-Content-Type: text/markdown
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 
-Public-data OSINT for one email, username, domain, or company: gathered from free sources,
+Public-data OSINT for one email, username, domain, company, phone number, or Bitcoin address: gathered from free sources,
 briefed by an LLM acting as a defensive analyst, rendered as a colour-coded report.
 
 `osintkit` uses only public sources: certificate transparency, public DNS, WHOIS, public GitHub
@@ -102,10 +103,11 @@ Everything else needs no credentials.
 
 | Command | Purpose |
 | --- | --- |
-| `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`) |
+| `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`, `--phone`, `--crypto`) |
 | `batch` | A CSV of targets, run concurrently, reported in order |
 | `diff` | What changed between two archived runs |
-| `password` | Is a password in Pwned Passwords (free, no key, hash-prefix only) |
+| `password` | Is a password in Pwned Passwords (`--offline` uses a bundled list, no network) |
+| `watch` | Re-check on an interval, print only changes, optionally notify |
 | `history` | Past runs, replayable by id |
 | `doctor` | Key, endpoint, and directory checks (`--deep` verifies auth) |
 | `collectors` | Every collector and what it touches |
@@ -146,6 +148,8 @@ the model fail.
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
 - **Validated output.** Strict JSON schema, one repair round-trip, then a clean failure.
+- **Confidence per section.** Each section states `low`, `medium`, or `high`, capped by how many
+  sources actually back it, so a single weak source never reads as certain.
 - **Self-checked claims.** Every breach, date, host, and account URL is compared back to the
   collected data; anything unsupported is called out.
 
@@ -172,6 +176,18 @@ Passwords are checked separately with `osintkit password`: Pwned Passwords cover
 millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
 machine.
 
+## Monitoring
+
+```bash
+osintkit watch --domain example.com --every 1d
+osintkit watch --email you@example.com --every 6h --no-notify
+```
+
+The first run prints a baseline. Later runs print nothing unless `diff` sees movement — a new
+breach, a new host, a source failing, or a risk change — and optionally raise a desktop
+notification through `notify-send`. `--cycles` bounds the loop, `ctrl-c` stops it, and every run
+is archived so you can inspect it afterwards. Pair with cron or a systemd timer for unattended use.
+
 ## Safety and legality
 
 - Public data only. No logins, no scraping behind auth, no paid brokers.

{osintkit-0.7.0 → osintkit-0.9.0}/README.md

@@ -6,7 +6,7 @@
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 
-Public-data OSINT for one email, username, domain, or company: gathered from free sources,
+Public-data OSINT for one email, username, domain, company, phone number, or Bitcoin address: gathered from free sources,
 briefed by an LLM acting as a defensive analyst, rendered as a colour-coded report.
 
 `osintkit` uses only public sources: certificate transparency, public DNS, WHOIS, public GitHub
@@ -70,10 +70,11 @@ Everything else needs no credentials.
 
 | Command | Purpose |
 | --- | --- |
-| `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`) |
+| `lookup` | One target, one report (`--email`, `--username`, `--domain`, `--company`, `--phone`, `--crypto`) |
 | `batch` | A CSV of targets, run concurrently, reported in order |
 | `diff` | What changed between two archived runs |
-| `password` | Is a password in Pwned Passwords (free, no key, hash-prefix only) |
+| `password` | Is a password in Pwned Passwords (`--offline` uses a bundled list, no network) |
+| `watch` | Re-check on an interval, print only changes, optionally notify |
 | `history` | Past runs, replayable by id |
 | `doctor` | Key, endpoint, and directory checks (`--deep` verifies auth) |
 | `collectors` | Every collector and what it touches |
@@ -114,6 +115,8 @@ the model fail.
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
 - **Validated output.** Strict JSON schema, one repair round-trip, then a clean failure.
+- **Confidence per section.** Each section states `low`, `medium`, or `high`, capped by how many
+  sources actually back it, so a single weak source never reads as certain.
 - **Self-checked claims.** Every breach, date, host, and account URL is compared back to the
   collected data; anything unsupported is called out.
 
@@ -140,6 +143,18 @@ Passwords are checked separately with `osintkit password`: Pwned Passwords cover
 millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
 machine.
 
+## Monitoring
+
+```bash
+osintkit watch --domain example.com --every 1d
+osintkit watch --email you@example.com --every 6h --no-notify
+```
+
+The first run prints a baseline. Later runs print nothing unless `diff` sees movement — a new
+breach, a new host, a source failing, or a risk change — and optionally raise a desktop
+notification through `notify-send`. `--cycles` bounds the loop, `ctrl-c` stops it, and every run
+is archived so you can inspect it afterwards. Pair with cron or a systemd timer for unattended use.
+
 ## Safety and legality
 
 - Public data only. No logins, no scraping behind auth, no paid brokers.

{osintkit-0.7.0 → osintkit-0.9.0}/docs/REFERENCE.md

@@ -7,6 +7,8 @@ Everything the README leaves out: every flag, every collector, storage, and fail
 | Collector | Targets | Source | Needs key |
 | --- | --- | --- | --- |
 | `infostealer` | email / username / domain | Hudson Rock stealer logs | no |
+| `phone_info` | phone | libphonenumber metadata, offline | no |
+| `btc_address` | crypto | Blockstream address history | no |
 | `hibp_breaches`, `hibp_pastes` | email | Have I Been Pwned | yes |
 | `xposed_or_not`, `xposed_analytics`, `leakcheck_public` | email | free public breach indexes | no |
 | `gravatar` | email | Gravatar | no |
@@ -62,6 +64,19 @@ Explicit `--base-url` and `--model` beat both the provider and the prefix. Tempe
 Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--offline`, `--dry-run`, `--only`, `--skip`,
 `--ports`, `--fail-fast`, `-c/--concurrency`, `--limit`, `--show`, `--days`, `--clear`, `--deep`.
 
+## Confidence
+
+Every section carries `low`, `medium`, or `high`. The value is derived from how many contributing
+sources returned data (two or more is high, one is medium) and the model may be more pessimistic
+but never more optimistic. A section backed by one index therefore cannot claim high confidence.
+
+## Watching
+
+`watch` repeats a lookup on an interval (`--every`, minimum 60s), prints a baseline, and then
+only reports diffs: added breaches or hosts, risk direction, source failure and recovery.
+`--notify` (default) calls `notify-send` when available; `--full` prints the whole report on a
+change; `--cycles N` bounds the loop. Every cycle is archived and logged like a normal run.
+
 ## Self-check
 
 After synthesis every breach name, date, subdomain, and account URL is compared with the supplied
@@ -87,7 +102,8 @@ domains, and record counts. At most 15 enriched rows go into the prompt; the tru
 
 ## Password checks
 
-`osintkit password [VALUE]` hashes locally, sends only the five-character SHA-1 prefix to
+`osintkit password --offline` checks the bundled 10k most-common list and never opens a socket;
+without `--offline` it hashes locally, sends only the five-character SHA-1 prefix to
 `api.pwnedpasswords.com`, and reports the count and a commonness rating. Exit code `1` means
 pwned. `--json` for machines. Nothing about the password beyond the prefix leaves the machine.
 

{osintkit-0.7.0 → osintkit-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "osintkit"
-version = "0.7.0"
+version = "0.9.0"
 description = "Public-data OSINT aggregator for emails, usernames, domains, and companies"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -29,6 +29,7 @@ dependencies = [
     "rich>=13.7",
     "dnspython>=2.6",
     "python-whois>=0.9",
+    "phonenumbers>=8.13",
 ]
 
 [project.optional-dependencies]

{osintkit-0.7.0 → osintkit-0.9.0}/src/osintkit/__init__.py

@@ -1,3 +1,3 @@
 """osintkit: a public-data OSINT aggregator."""
 
-__version__ = "0.7.0"
+__version__ = "0.9.0"

{osintkit-0.7.0 → osintkit-0.9.0}/src/osintkit/cli.py

@@ -18,7 +18,18 @@ from rich.console import Console
 from rich.panel import Panel
 from rich.table import Table
 
-from . import __version__, diff, doctor, passwords, pipeline, render, retention, userconfig
+from . import (
+    __version__,
+    diff,
+    doctor,
+    passwords,
+    passwords_offline,
+    pipeline,
+    render,
+    retention,
+    userconfig,
+    watch,
+)
 from .collectors import REGISTRY
 from .config import (
     DEFAULT_RESOLVERS,
@@ -139,6 +150,8 @@ def _pick_target(
     username: str | None,
     domain: str | None,
     company: str | None,
+    phone: str | None = None,
+    crypto: str | None = None,
 ) -> tuple[str, str | None]:
     supplied = [
         (name, value)
@@ -147,16 +160,18 @@ def _pick_target(
             ("username", username),
             ("domain", domain),
             ("company", company),
+            ("phone", phone),
+            ("crypto", crypto),
         )
         if value
     ]
     if len(supplied) > 1:
-        raise TargetParseError("pass only one of --email/--username/--domain/--company")
+        raise TargetParseError("pass only one of --email/--username/--domain/--company/--phone/--crypto")
     if supplied:
         kind, value = supplied[0]
         return value, kind
     if not target:
-        raise TargetParseError("give a target or one of --email/--username/--domain/--company")
+        raise TargetParseError("give a target or one of --email/--username/--domain/--company/--phone/--crypto")
     return target, None
 
 
@@ -249,6 +264,8 @@ def lookup(
     username: str | None = typer.Option(None, "--username", help="Username target."),
     domain: str | None = typer.Option(None, "--domain", help="Domain target."),
     company: str | None = typer.Option(None, "--company", help="Company target."),
+    phone: str | None = typer.Option(None, "--phone", help="Phone target (E.164, e.g. +15551234567)."),
+    crypto: str | None = typer.Option(None, "--crypto", help="Bitcoin address target."),
     json_out: bool = typer.Option(False, "--json", help="Raw structured JSON on stdout."),
     markdown: bool = typer.Option(False, "--markdown", help="Write a Markdown report."),
     out_path: Path | None = typer.Option(None, "--out", "-o", help="Markdown destination."),
@@ -277,7 +294,7 @@ def lookup(
     if out_path:
         settings.extra["markdown_path"] = str(out_path)
     try:
-        raw, declared = _pick_target(target, email, username, domain, company)
+        raw, declared = _pick_target(target, email, username, domain, company, phone, crypto)
     except TargetParseError as exc:
         out.print(f"[red]{exc}[/red]")
         raise typer.Exit(2) from exc
@@ -639,10 +656,64 @@ def init(
     out.print("[dim]try: osintkit lookup --domain example.com[/dim]")
 
 
+@app.command("watch")
+def watch_cmd(
+    target: str | None = typer.Argument(None, help="Email, username, domain, or company."),
+    email: str | None = typer.Option(None, "--email", help="Email target."),
+    username: str | None = typer.Option(None, "--username", help="Username target."),
+    domain: str | None = typer.Option(None, "--domain", help="Domain target."),
+    company: str | None = typer.Option(None, "--company", help="Company target."),
+    phone: str | None = typer.Option(None, "--phone", help="Phone target (E.164, e.g. +15551234567)."),
+    crypto: str | None = typer.Option(None, "--crypto", help="Bitcoin address target."),
+    every: str = typer.Option("1d", "--every", help="Interval: 30m, 6h, 1d."),
+    cycles: int = typer.Option(0, "--cycles", min=0, help="Stop after N runs; 0 means forever."),
+    full: bool = typer.Option(False, "--full", help="Print the whole report on each change."),
+    notify_changes: bool = typer.Option(True, "--notify/--no-notify", help="Desktop notification."),
+    offline: bool = typer.Option(False, "--offline", help="Local report only; no model, no key."),
+    only: list[str] | None = typer.Option(None, "--only", help="Run only these collectors."),
+    skip: list[str] | None = typer.Option(None, "--skip", help="Skip these collectors."),
+) -> None:
+    """Re-check a target on a schedule and report only changes."""
+    out = _console()
+    try:
+        interval = watch.parse_duration(every)
+        raw, declared = _pick_target(target, email, username, domain, company, phone, crypto)
+    except (ValueError, TargetParseError) as exc:
+        out.print(f"[red]{exc}[/red]")
+        raise typer.Exit(2) from exc
+
+    settings = _settings(offline=offline, output_json=False, output_markdown=False, raw=False)
+
+    async def run_once():
+        outcome = await pipeline.execute(
+            raw, settings, RunLogger(pipeline.new_run_id()), out, declared_type=declared
+        )
+        return outcome.report
+
+    def on_report(report, lines, baseline):
+        watch.render_event(report, lines, baseline, out, full=full)
+        if lines and notify_changes:
+            body = "; ".join(lines)[:180]
+            watch.notify(f"change for {report.target}", body)
+
+    out.print(
+        f"[dim]watching {render.escape(raw)} every {every}"
+        + (f", {cycles} runs" if cycles else "")
+        + " · ctrl-c stops[/dim]"
+    )
+    try:
+        changes = asyncio.run(watch.run(raw, run_once, on_report, every=interval, cycles=cycles))
+    except KeyboardInterrupt:
+        out.print("[yellow]stopped[/yellow]")
+        return
+    out.print(f"[dim]{changes} change event(s)[/dim]")
+
+
 @app.command()
 def password(
     value: str | None = typer.Argument(None, help="Password to check; prompt if omitted."),
     json_out: bool = typer.Option(False, "--json", help="JSON output."),
+    offline: bool = typer.Option(False, "--offline", help="Use only the bundled list; no network."),
 ) -> None:
     """Check a password against Pwned Passwords, without sending it."""
     out = _console()
@@ -656,6 +727,32 @@ def password(
         out.print("[red]no password given[/red]")
         raise typer.Exit(2)
 
+    local_rank = passwords_offline.check(secret)
+    if offline:
+        if local_rank:
+            if json_out:
+                print(
+                    json.dumps(
+                        {
+                            "pwned": True,
+                            "rank": local_rank,
+                            "list_size": passwords_offline.size(),
+                            "checked_by": "bundled list",
+                        }
+                    )
+                )
+            else:
+                out.print(
+                    f"[red]common[/red] rank #{local_rank:,} of {passwords_offline.size():,} "
+                    "(bundled list, no network)"
+                )
+            raise typer.Exit(1)
+        if json_out:
+            print(json.dumps({"pwned": False, "checked_by": "bundled list"}))
+        else:
+            out.print(f"not in the bundled top {passwords_offline.size():,}; not proof of strength")
+        return
+
     settings: Settings = STATE["settings"]  # type: ignore[assignment]
 
     async def run() -> dict[str, object]:

{osintkit-0.7.0 → osintkit-0.9.0}/src/osintkit/collectors/__init__.py

@@ -8,6 +8,7 @@ from . import (  # noqa: F401  (import order matters: side-effect registration)
     ct,
     dns,
     github,
+    identifiers,
     infostealer,
     pastes,
     ports,

osintkit-0.9.0/src/osintkit/collectors/identifiers.py

@@ -0,0 +1,65 @@
+"""Phone metadata (offline) and Bitcoin address history."""
+
+from __future__ import annotations
+
+import phonenumbers
+from phonenumbers import PhoneNumberType, carrier, geocoder, timezone
+
+from .base import Context, collector
+
+BTC = "https://blockstream.info/api/address"
+LINE_TYPES = {
+    value: name
+    for name, value in vars(PhoneNumberType).items()
+    if isinstance(value, int) and not name.startswith("_")
+}
+
+
+@collector("phone_info", ("phone",), "Phone region, carrier, and line type", order=15, ttl=2592000)
+async def phone_info(ctx: Context) -> dict:
+    try:
+        parsed = phonenumbers.parse(ctx.target, None)
+    except phonenumbers.NumberParseException as exc:
+        return {"valid": False, "note": str(exc)}
+    return {
+        "valid": phonenumbers.is_valid_number(parsed),
+        "possible": phonenumbers.is_possible_number(parsed),
+        "region": phonenumbers.region_code_for_number(parsed),
+        "country": geocoder.description_for_number(parsed, "en") or None,
+        "carrier": carrier.name_for_number(parsed, "en") or None,
+        "line_type": LINE_TYPES.get(phonenumbers.number_type(parsed), "UNKNOWN"),
+        "timezones": list(timezone.time_zones_for_number(parsed)),
+        "e164": phonenumbers.format_number(parsed, phonenumbers.PhoneNumberFormat.E164),
+        "international": phonenumbers.format_number(parsed, phonenumbers.PhoneNumberFormat.INTERNATIONAL),
+        "source": "libphonenumber",
+    }
+
+
+@collector("btc_address", ("crypto",), "Bitcoin address balances and transaction history", order=16, ttl=3600)
+async def btc_address(ctx: Context) -> dict:
+    response = await ctx.http.get(
+        f"{BTC}/{ctx.target}",
+        namespace="blockstream",
+        empty_on=(400, 404),
+        timeout=ctx.http_timeout or 30,
+    )
+    if response.status_code != 200:
+        return {"found": False, "note": f"HTTP {response.status_code}"}
+    try:
+        body = response.json()
+    except ValueError:
+        return {"found": False, "note": "non-JSON"}
+
+    chain = body.get("chain_stats") or {}
+    mempool = body.get("mempool_stats") or {}
+    funded = int(chain.get("funded_txo_sum") or 0)
+    spent = int(chain.get("spent_txo_sum") or 0)
+    return {
+        "found": True,
+        "balance_sats": funded - spent,
+        "balance_btc": round((funded - spent) / 100_000_000, 8),
+        "tx_count": int(chain.get("tx_count") or 0),
+        "received_sats": funded,
+        "mempool_tx_count": int(mempool.get("tx_count") or 0),
+        "source": "blockstream.info",
+    }

osintkit-0.9.0/src/osintkit/confidence.py

@@ -0,0 +1,55 @@
+"""Per-section confidence, capped by how many sources actually back a section."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .models import CollectorResult
+
+SECTIONS = ("breaches", "accounts", "infrastructure", "subdomains")
+ORDER = ("low", "medium", "high")
+
+CONTRIBUTORS: dict[str, frozenset[str]] = {
+    "breaches": frozenset({"breach_index"}),
+    "accounts": frozenset({"username_presence", "github_profile", "github_commit_search"}),
+    "infrastructure": frozenset(
+        {
+            "dns_records",
+            "dns_mail_posture",
+            "dns_wildcard",
+            "whois_registration",
+            "crt_sh_certificates",
+            "tcp_ports",
+            "infostealer",
+            "phone_info",
+            "btc_address",
+        }
+    ),
+    "subdomains": frozenset({"crt_sh_subdomains", "passive_subdomains"}),
+}
+
+
+def _rank(value: str) -> int:
+    return ORDER.index(value) if value in ORDER else 0
+
+
+def derive(results: list[CollectorResult]) -> dict[str, str]:
+    """Confidence implied by the data: 2+ contributing sources is high, 1 medium, 0 low."""
+    out: dict[str, str] = {}
+    for section, names in CONTRIBUTORS.items():
+        count = sum(1 for result in results if result.collector in names and result.has_data)
+        if section == "breaches":
+            rows = next((r.data for r in results if r.collector == "breach_index" and r.has_data), [])
+            count = min(len(rows), 2) if rows else 0
+        out[section] = "high" if count >= 2 else "medium" if count else "low"
+    return out
+
+
+def apply(chosen: dict[str, Any] | None, derived: dict[str, str]) -> dict[str, str]:
+    """Keep the model's honest pessimism, but never let it outrank the evidence."""
+    final: dict[str, str] = {}
+    for section in SECTIONS:
+        claimed = str((chosen or {}).get(section) or "").strip().lower()
+        floor = derived.get(section, "low")
+        final[section] = claimed if claimed in ORDER and _rank(claimed) <= _rank(floor) else floor
+    return final