# Phase 16: OSINT Threat Intel, Mobile, DNS & API Marketplaces - Context

**Gathered:** 2026-04-06
**Status:** Ready for planning
**Mode:** Auto-generated

<domain>
## Phase Boundary
Adds ReconSource implementations for threat intelligence platforms (VirusTotal, IntelligenceX, URLScan), mobile app analysis (APKMirror), DNS/certificate transparency (crt.sh, SecurityTrails), and API marketplaces/documentation hubs (Postman, SwaggerHub, RapidAPI) to detect API keys exposed in threat feeds, mobile binaries, certificate records, and public API collections.
</domain>

<decisions>
## Implementation Decisions
### Claude's Discretion
All implementation choices are at Claude's discretion. Follow the established Phase 10 pattern: each source implements recon.ReconSource, uses pkg/recon/sources/httpclient.go for HTTP, uses httptest for tests. Each source goes in its own file.
</decisions>

<code_context>
## Existing Code Insights
### Reusable Assets
- pkg/recon/sources/ — established source implementation pattern from Phase 10
- pkg/recon/sources/httpclient.go — shared retry HTTP client
- pkg/recon/sources/register.go — RegisterAll (extend per phase)
- pkg/recon/source.go — ReconSource interface
</code_context>

<specifics>
## Specific Ideas
- VirusTotalSource — search VirusTotal for samples/URLs containing API keys
- IntelligenceXSource — search IntelligenceX archives for leaked credentials
- URLScanSource — search urlscan.io scan results for exposed keys
- APKMirrorSource — download and analyze APK files for embedded API keys
- CrtShSource — search crt.sh certificate transparency logs for key-related domains
- SecurityTrailsSource — search SecurityTrails DNS/historical data for key exposure
- PostmanSource — search public Postman collections/workspaces for API keys
- SwaggerHubSource — search public SwaggerHub API definitions for embedded keys
- RapidAPISource — search RapidAPI public listings for exposed credentials
</specifics>

<deferred>
## Deferred Ideas
None — straightforward source implementations.
</deferred>
