Osint Due Diligence

OSINT Due Diligence

Orchestrate open-source intelligence investigations on companies and individuals using CLI tools with a structured methodology grounded in professional standards (Berkeley Protocol, Bellingcat, IntelTechniques).

Overview

This skill turns Hermes Agent into a due diligence investigator. It provides:

1. A phased methodology for company (8 phases) and individual (7 phases) investigations — what to look for, in what order, from which sources.
2. A curated toolkit of 30+ CLI-first OSINT tools organized by category — which tool to reach for at each phase.
3. A reporting framework that produces structured, evidence-backed due diligence reports with source documentation, red flags, and risk ratings.
4. Red flag catalogs for both company and individual investigations so nothing is missed.

The methodology traces to the Berkeley Protocol (UN-backed international standard), Bellingcat's investigative journalism standards, and Michael Bazzell's IntelTechniques practitioner framework. See references/methodology.md for the full academic grounding.

When to Use

• Investigating a company before a business partnership, investment, or vendor relationship
• Third-party vendor risk assessment — cyber security, data protection, GDPR/NIS2/DORA compliance
• Assessing a vendor/processor before signing a DPA or data-sharing agreement
• Background-checking an individual (hire, board appointment, counter-party)
• Verifying claims made by an entity (credentials, history, associations)
• Assessing sanctions, PEP, or regulatory exposure
• Mapping an entity's digital footprint and breach exposure
• Completing a TPRM (Third-Party Risk Management) questionnaire or security review
• Any scenario where the user says "look into," "check out," "due diligence," "vendor assessment," "supplier risk," "background check," "investigate," "vet this vendor," or "what do we know about"

Don't use for: Criminal investigations requiring legal authority, accessing paywalled/classified data without authorization, or replacing legal counsel's formal DD process. This skill uses publicly available information only.

Prerequisites

Install the core toolset before the first investigation:

# Python tools (pip-installable)
pip install sherlock-project maigret holehe theHarvester spiderfoot shodan h8mail recon-ng instaloader toutatis

# Go-based tools
go install github.com/owasp-amass/amass/v4/...@master
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Optional: Docker-based tools for heavy automation
# docker pull smicallef/spiderfoot   (if not using pip version)
# docker pull yogeshojha/rengine      (full recon framework with web UI)

See scripts/install-tools.sh for a one-shot installation script.

API keys to configure (optional but recommended):

• Have I Been Pwned (HIBP) API key — breach checking
• Shodan API key — device/infrastructure search
• DeHashed API key — breach data search
• OpenCorporates API key — company registry queries (higher rate limits)

Investigation Workflows

Company Due Diligence (8 Phases)

Execute phases in order. Each phase builds on the previous. Skip phases only when explicitly told to.

Phase 1: Corporate Identity & Structure Goal: Confirm the entity legally exists and understand its structure.

theHarvester -d  -b all                    # emails, subdomains, names
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=" | python3 -m json.tool
# Check national business registry (Companies House, SEC EDGAR, etc.)
spiderfoot-cli -s  -t DOMAIN_NAME,EMAIL_ADDRESS,HUMAN_NAME

What to record: legal name, registration number, jurisdiction, date of incorporation, legal structure, officers/directors, filing history.

Phase 2: Financial Health Goal: Assess financial stability, funding, and red flags.

# Search SEC EDGAR for public filings
# Check Crunchbase/PitchBook for funding rounds
# Look for tax liens, judgments, bankruptcies via court records

Sources: SEC EDGAR, annual reports, D&B, Experian, court records, Crunchbase. Use the browser for registries without APIs.

Phase 3: Regulatory & Compliance Goal: Screen for sanctions, watchlists, and regulatory actions.

# Check OFAC SDN list
curl -s "https://sanctionslistservice.ofac.treas.gov/api/Search" # requires setup
# Check industry-specific regulators (FINRA, FDA, EPA, FTC)

What to record: sanctions matches, PEP status, regulatory enforcement history, license validity.

Phase 4: Litigation & Legal History Goal: Uncover lawsuits, criminal proceedings, regulatory enforcement.

# Browser-based: PACER (US), state court databases, LexisNexis, Westlaw
# For non-US: national court databases, EUR-Lex, BAILII

Phase 5: Reputation & Media Goal: Assess public perception, controversies, customer sentiment.

# Browser: Google News, Factiva, Glassdoor, BBB, TrustPilot
# Social media monitoring

Phase 6: Operations & Supply Chain Goal: Understand physical presence, scale, products, IP.

shodan domain                                # exposed infrastructure
amass enum -d                                # subdomain mapping
subfinder -d                                 # passive subdomain enum

What to record: locations, employee count via LinkedIn, IP portfolio (USPTO), major customers/suppliers.

Phase 7: Digital Footprint & Cybersecurity Goal: Map online presence, breach history, security posture.

curl -s "https://haveibeenpwned.com/api/v3/breacheddomain/" -H "hibp-api-key: $HIBP_KEY"
h8mail -t                                     # breach hunting
shodan host                                      # exposed services
# Check Wayback Machine for historical website changes

What to record: domains, breach exposure, exposed services, historical web presence.

Phase 8: Beneficial Ownership & Network Analysis Goal: Identify who really owns/controls the entity.

curl -s "https://api.opencorporates.com/v0.4/companies///statements"
# Search ICIJ Offshore Leaks database
# Search OCCRP database

What to record: UBOs, offshore structures, political connections, related entities.

Individual Due Diligence (7 Phases)

Phase 1: Identity Verification — Confirm name, aliases, DOB, nationality via public records.

Phase 2: Professional History — LinkedIn, SEC filings (board roles), Google Scholar, USPTO patents.

theHarvester -d  -b linkedin
# Browser: LinkedIn profile analysis

Phase 3: Financial Profile — Property records, bankruptcy, tax liens, sanctions.

Phase 4: Legal & Criminal History — Court databases, sex offender registries, professional discipline.

Phase 5: Digital Footprint — Social media, usernames, emails, breach exposure.

sherlock                                   # 400+ social networks
maigret  --all-sites                       # 3000+ sites, detailed dossier
holehe                                        # 120+ site registration check
h8mail -t                                     # breach/leak search
ghunt email                                   # Google account investigation

Phase 6: Associations & Network — Business partners, family, political donations, social graph.

Phase 7: Reputation & Media — News mentions, social sentiment, controversy, awards.

Fuzzy Search & Partial Information

Real investigations rarely start with complete, verified data. Use these strategies when you have ambiguous, partial, or uncertain input.

Step 0: Assess what you actually have. Before running any tools, categorize the input:

• Exact & verified — full legal name, confirmed domain, known email → proceed with standard phases
• Partial — first name only, company without jurisdiction, username without platform → generate variants first
• Ambiguous — common name (John Smith), name in non-Latin script, nickname, typo possible → widen search, then narrow
• Single data point — only a phone number, only an email, only a domain → pivot from that point

Name variant generation. For individual names, generate all plausible variants before searching:

# Use the variant generator script
python3 scripts/generate-variants.py "Robert J. Smith"

# Manual strategy if script unavailable:
# 1. Full formal:     Robert James Smith
# 2. First + Last:    Robert Smith
# 3. Initial + Last:  R. Smith, R Smith, RJ Smith
# 4. Nicknames:       Bob Smith, Bobby Smith, Rob Smith
# 5. Reversed:        Smith Robert, Smith R
# 6. Common typos:    Robert Smyth, Robert Smithe
# 7. Hyphenated:      Robert James-Smith
# 8. Middle name as first: James Smith

Run Sherlock/Maigret with the top 3-5 most likely variants in parallel. Cross-reference results — matching profile photos or consistent bios across variants increase confidence.

Company name variant strategy. Legal names differ from trading names:

# Example: "Acme Corp" could be registered as:
# - Acme Corporation
# - Acme Corp LLC
# - Acme Corp Ltd
# - Acme Corporate
# - The Acme Corporation
# - Acme (without suffix)

# Search strategy:
# 1. Exact match on OpenCorporates
# 2. Fuzzy/starts-with search on OpenCorporates
# 3. Domain WHOIS lookup (acme.com → find registrant name)
# 4. LinkedIn search for company page
# 5. Trademark database search (USPTO/WIPO)

Phonetic matching. When you only know how a name sounds (heard verbally, transliterated from non-Latin script):

# Soundex/Metaphone variants for "Mohammed":
# Muhammad, Mohammad, Mohamed, Muhammed, Mohamad, Muhamed
# Strategy: generate all common transliterations, search all of them

# Use the variant script with --phonetic flag:
python3 scripts/generate-variants.py "Mohammed" --phonetic

Pivoting from a single data point:

| You have | Pivot to find | |----------|--------------| | Email address | Username (part before @), domain → company, holehe registered sites | | Phone number | Carrier lookup → country/city → name databases, WhatsApp/Telegram check | | Domain name | WHOIS → registrant, theHarvester → emails, Amass → subdomains | | Username | Maigret/Sherlock → other profiles → real name, email, location | | Profile photo | Reverse image search → other accounts, original source | | Physical address | Property records → owner, Google Maps → business at location |

When to widen vs narrow:

• Widen when: zero results on initial search, common name (need to find the right one), entity may have rebranded
• Narrow when: too many results (add location, age range, employer), found probable match (verify with additional data points)
• Stop widening when: you have 5-15 candidate matches to verify
• Stop narrowing when: you have 1-3 high-confidence matches with 2+ corroborating data points each

Uncertainty tracking. When input is fuzzy, tag every finding with confidence:

• [Confirmed] — 2+ independent sources agree, no contradictions
• [Probable] — 1 strong source + circumstantial support, or 2 sources with minor inconsistency
• [Possible] — 1 source only, or plausible but unverified
• [Unverified] — Lead only, needs follow-up investigation
• [Disconfirmed] — Was a candidate but ruled out by contradictory evidence

Multi-wave search strategy for common names:

Wave 1: Name + known location (city/country)
Wave 2: Name + known employer/school
Wave 3: Name + known username/email
Wave 4: Cross-reference waves 1-3 — which person appears in multiple?
Wave 5: Deep-dive on the intersecting candidate(s)

Never present a common-name search result as definitive without corroborating data points (location, employer, photo match, consistent bio details).

Third-Party Vendor Cyber Risk & Data Protection Assessment

Use this workflow when vetting a vendor, processor, or technology partner before sharing data, integrating systems, or signing a contract. This is the compliance-grade variant of company DD — designed for DPA (Data Protection Agreement) due diligence, GDPR Article 28 assessments, and cyber supply chain risk management.

When to use this variant instead of standard company DD:

• Vendor will process personal data on your behalf (GDPR processor assessment)
• Vendor will connect to your network/systems (cyber supply chain risk)
• Vendor will host or store your data (cloud/SaaS assessment)
• Regulatory requirement (GDPR, NIS2, DORA, PCI DSS, HIPAA, POPIA)
• You're completing a vendor security questionnaire or TPRM (Third-Party Risk Management) assessment

Phase V1: Data Protection & Privacy Posture

Goal: Understand what data the vendor handles, where, and under what legal framework.

Checklist:
- What personal data categories does the vendor process? (PII, health, financial, minors, etc.)
- Where is data stored/processed? (data residency — specific countries/regions)
- Does the vendor transfer data internationally? If so, under what mechanism? (SCCs, BCRs, adequacy decision)
- Does the vendor have a DPA (Data Protection Agreement) or DPA template available?
- Does the vendor use subprocessors? If so, who are they and where are they?
- What is the vendor's breach notification timeline? (GDPR requires 72 hours)
- Privacy policy: clear, accessible, GDPR-compliant? Or vague and buried?
- Cookie/tracking consent mechanism on their website (basic hygiene check)

Key sources:
- Vendor's privacy policy and terms of service
- Vendor's DPA (if published)
- Subprocessor list (required by GDPR Art. 28 for processors)
- ICO/DPA register (UK), CNIL (France), or local DPA public registers

Phase V2: Security Certifications & Assurance

Goal: Verify the vendor's security claims with independent evidence.

Checklist:
- SOC 2 Type II report — request and review (not just "SOC 2 compliant" claim)
- ISO 27001 certificate — verify on the certification body's public register
- PCI DSS compliance — if handling payment card data, verify on VISA/Mastercard registers
- HIPAA compliance — if handling US health data, request BAA (Business Associate Agreement)
- FedRAMP — if US government, verify on the FedRAMP marketplace
- Cyber Essentials / Cyber Essentials Plus (UK)
- Penetration test summary — when was the last test? By whom? Remediation status?
- Bug bounty or vulnerability disclosure program — does it exist? Is it responsive?

Key sources:
- Certification body public registers (ISO 27001: look up the cert number on the CB's site)
- Vendor's trust/security page
- SOC 2 report (request directly — not publicly available)
- Bug bounty platforms: HackerOne, Bugcrowd

Phase V3: Breach & Incident History

Goal: Has this vendor been breached? How did they handle it?

h8mail -t @                            # employee emails in breaches
curl -s "https://haveibeenpwned.com/api/v3/breaches" | grep -i ""
# Search: " data breach" " security incident"
# Search: " ransomware" " leak"

Checklist:
- Any publicly disclosed breaches? When? What data? Root cause?
- Any regulatory fines or enforcement actions? (ICO, CNIL, FTC, state AGs)
- Any class action lawsuits related to data breaches or privacy violations?
- Any dark web mentions of the vendor's data? (ransomware leak sites, forums)
- How did the vendor respond to past incidents? Transparent or evasive?
- Any past-due security patches or end-of-life software mentioned in breach reports?

Key sources:
- Have I Been Pwned (domain search)
- State AG data breach notifications (US)
- ICO enforcement action register (UK)
- FTC privacy enforcement cases
- Google News search for breach history
- Ransomware leak site monitoring (Ransomlook, DarkFeed)

Phase V4: Technical Security Posture

Goal: Assess the vendor's externally visible security hygiene.

shodan domain                           # exposed services
amass enum -d                           # subdomain discovery
subfinder -d                             # passive subdomain enum

# Check TLS/SSL configuration
curl -sI https:// | grep -i strict-transport-

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [mtjikuzu](https://github.com/mtjikuzu)
- **Source:** [mtjikuzu/hermes-osint-skill](https://github.com/mtjikuzu/hermes-osint-skill)
- **License:** MIT

Install and usage instructions live in the source repository linked above.