OSINT Lookups Guide

What OSINT Lookups Are

OSINT lookups are quick enrichment calls for a single indicator. They are best when you already have one identifier from a breach, stealer log, scanner alert, or manual investigation and want surrounding context. Use them to answer questions like:

who owns this Discord, Steam, Xbox, Roblox, Google, or Minecraft account?
has this email appeared on common signup surfaces?
what network, country, ISP, or risk flags are tied to this IP?
what subdomains are visible for a domain, and which ones are alive?

Use this page for meaning and workflow guidance. Use the generated OpenAPI reference for exact parameters, schemas, enums, and playground requests.

Lookup Families

Lookup	Input	What it helps explain
IP info	IP address	Location, ISP, ASN, mobile/proxy/hosting signals, and reverse DNS
Steam	Steam64 ID or custom URL name	Public Steam identity, avatar, and raw profile metadata
Xbox	Gamertag or XUID	Xbox identity, avatar, gamer score, account tier, and related profile metadata
Discord user info	Discord snowflake ID	Username, global name, avatar, banner, creation date, and badges
Discord username history	Discord snowflake ID	Prior usernames and the timestamps returned by the upstream source
Roblox user info	Roblox user ID or username	Roblox identity, display name, old usernames, join date, avatar, and Discord hints
Holehe	Email address	Which common services appear to have an account for the email
GHunt	Gmail address	Public Google profile details when the upstream source can resolve them
Subdomain extraction	Domain	Known subdomains and optional live-check details
Minecraft history	Minecraft username	Historical Minecraft names

Response Shape

Most OSINT lookups use the standard API envelope:

{
  "success": true,
  "message": "Request completed successfully",
  "data": {},
  "lookups_left": 999,
  "search_session": {
    "id": "sess_abc123"
  }
}

The important part is data. Each provider returns a different shape because each source exposes different evidence. For example, IP info has geographic and network fields, Discord has profile fields, and subdomain extraction can return either plain host strings or objects with live-check metadata.

Search Sessions

Pass search_id when the lookup belongs to an existing investigation. This keeps related breach, stealer, victim, and OSINT calls grouped together and can avoid spending extra lookups for the same investigation context.

curl -G "https://oathnet.org/api/service/discord-userinfo" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "discord_id=300760994454437890" \
  --data-urlencode "search_id=sess_abc123"

Identity Enrichment Flow

A common flow starts from a Discord ID found in breach or stealer data:

Call Discord user info to confirm the visible account.
Call Discord username history to see prior names.
If you already have a Roblox ID or username from another source, call Roblox user info for profile details.

import requests

headers = {"x-api-key": "YOUR_API_KEY"}
discord_id = "300760994454437890"

discord = requests.get(
    "https://oathnet.org/api/service/discord-userinfo",
    params={"discord_id": discord_id},
    headers=headers,
).json()

history = requests.get(
    "https://oathnet.org/api/service/discord-username-history",
    params={"discord_id": discord_id},
    headers=headers,
).json()

print(discord["data"].get("username"))
for entry in history["data"].get("history", []):
    print(entry.get("name"), entry.get("time"))

Email Enrichment Flow

For Gmail addresses, GHunt can return public Google profile data when available. For any email address, Holehe helps identify where that address may have signup presence.

curl -G "https://oathnet.org/api/service/ghunt" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "email=user@gmail.com"

curl -G "https://oathnet.org/api/service/holehe" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "email=user@gmail.com"

GHunt responses use a nested provider shape. In SDKs and raw JSON, expect profile details under data.data.profile, with provider errors surfaced separately when present.

Domain Enrichment Flow

Subdomain extraction helps turn a root domain into concrete hosts you can use for stealer, breach, scanner, or asset-review workflows.

curl -G "https://oathnet.org/api/service/extract-subdomain" \
  -H "x-api-key: YOUR_API_KEY" \
  --data-urlencode "domain=example.com" \
  --data-urlencode "is_alive=true"

When is_alive=true, subdomain entries may include metadata such as whether the host appears reachable. Code should accept both plain string entries and object entries.

Provider Caveats

OSINT providers can change response details without warning.
Some lookups return partial data when a profile exists but a provider hides a field.
External provider downtime may produce temporary lookup errors.
Discord username-history entries can contain arrays for name and time.
Roblox responses may include human-readable keys such as Current Username and Display Name.
Use OpenAPI for exact current field names before building strict parsers.

OpenAPI Reference

Check exact OSINT request and response schemas in the generated reference

Getting Started

Search Guides

OSINT And Utility Guides

Integration Guides

Resources

What OSINT Lookups Are

Lookup Families

Response Shape

Search Sessions

Identity Enrichment Flow

Email Enrichment Flow

Domain Enrichment Flow

Provider Caveats

OpenAPI Reference

​What OSINT Lookups Are

​Lookup Families

​Response Shape

​Search Sessions

​Identity Enrichment Flow

​Email Enrichment Flow

​Domain Enrichment Flow

​Provider Caveats

OpenAPI Reference

What OSINT Lookups Are

Lookup Families

Response Shape

Search Sessions

Identity Enrichment Flow

Email Enrichment Flow

Domain Enrichment Flow

Provider Caveats