docs(16-01): complete threat intelligence sources plan

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.planning/REQUIREMENTS.md

@@ -187,9 +187,9 @@ Requirements for initial release. Each maps to roadmap phases.
 
 ### OSINT/Recon — Threat Intelligence
 
-- [ ] **RECON-INTEL-01**: VirusTotal file and URL search
+- [x] **RECON-INTEL-01**: VirusTotal file and URL search
-- [ ] **RECON-INTEL-02**: Intelligence X aggregated search
+- [x] **RECON-INTEL-02**: Intelligence X aggregated search
-- [ ] **RECON-INTEL-03**: URLhaus search
+- [x] **RECON-INTEL-03**: URLhaus search
 
 ### OSINT/Recon — Mobile & DNS
 

.planning/STATE.md

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 15-03-PLAN.md
+stopped_at: Completed 16-01-PLAN.md
-last_updated: "2026-04-06T13:37:48.053Z"
+last_updated: "2026-04-06T13:46:09.387Z"
 last_activity: 2026-04-06
 progress:
   total_phases: 18
   completed_phases: 14
   total_plans: 81
-  completed_plans: 80
+  completed_plans: 81
   percent: 20
 ---
 
@@ -99,6 +99,7 @@ Progress: [██░░░░░░░░] 20%
 | Phase 14 P01 | 4min | 1 tasks | 14 files |
 | Phase 15 P01 | 3min | 2 tasks | 13 files |
 | Phase 15 P03 | 4min | 2 tasks | 11 files |
+| Phase 16 P01 | 4min | 2 tasks | 6 files |
 
 ## Accumulated Context
 
@@ -148,6 +149,9 @@ Recent decisions affecting current work:
 - [Phase 14]: RegisterAll extended to 45 sources (40 Phase 10-13 + 5 Phase 14 CI/CD); CircleCI gets dedicated CIRCLECI_TOKEN
 - [Phase 15]: Discord/Slack use dorking approach (configurable search endpoint) since neither has public message search API
 - [Phase 15]: Log aggregator sources are credentialless, targeting exposed instances
+- [Phase 16]: VT uses x-apikey header per official API v3 spec
+- [Phase 16]: IX uses three-step flow: POST search, GET results, GET file content
+- [Phase 16]: URLhaus tag lookup with payload endpoint fallback
 
 ### Pending Todos
 
@@ -162,6 +166,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-04-06T13:32:52.610Z
+Last session: 2026-04-06T13:46:09.383Z
-Stopped at: Completed 15-03-PLAN.md
+Stopped at: Completed 16-01-PLAN.md
 Resume file: None

.planning/phases/16-osint_threat_intel_mobile_dns_api_marketplaces/16-01-SUMMARY.md

@@ -0,0 +1,99 @@
+---
+phase: 16-osint-threat-intel-mobile-dns-api-marketplaces
+plan: 01
+subsystem: recon
+tags: [virustotal, intelligencex, urlhaus, threat-intel, osint]
+
+requires:
+  - phase: 09-osint-infrastructure
+    provides: ReconSource interface, LimiterRegistry, Client, BuildQueries, ciLogKeyPattern
+provides:
+  - VirusTotalSource implementing ReconSource (credential-gated)
+  - IntelligenceXSource implementing ReconSource (credential-gated)
+  - URLhausSource implementing ReconSource (credentialless)
+affects: [16-osint-wiring, recon-engine-registration]
+
+tech-stack:
+  added: []
+  patterns: [three-step IX search flow (initiate/results/read), VT x-apikey auth, URLhaus form-encoded POST with tag/payload fallback]
+
+key-files:
+  created:
+    - pkg/recon/sources/virustotal.go
+    - pkg/recon/sources/virustotal_test.go
+    - pkg/recon/sources/intelligencex.go
+    - pkg/recon/sources/intelligencex_test.go
+    - pkg/recon/sources/urlhaus.go
+    - pkg/recon/sources/urlhaus_test.go
+  modified: []
+
+key-decisions:
+  - "VT uses x-apikey header per official API v3 spec"
+  - "IX uses three-step flow: POST search, GET results, GET file content per record"
+  - "URLhaus tag lookup with payload endpoint fallback for broader coverage"
+
+patterns-established:
+  - "Threat intel sources follow same SentrySource pattern with ciLogKeyPattern matching"
+
+requirements-completed: [RECON-INTEL-01, RECON-INTEL-02, RECON-INTEL-03]
+
+duration: 4min
+completed: 2026-04-06
+---
+
+# Phase 16 Plan 01: Threat Intelligence Sources Summary
+
+**VirusTotal, IntelligenceX, and URLhaus recon sources for detecting API keys in malware samples, breach archives, and malicious URL databases**
+
+## Performance
+
+- **Duration:** 4 min
+- **Started:** 2026-04-06T13:43:29Z
+- **Completed:** 2026-04-06T13:47:29Z
+- **Tasks:** 2
+- **Files modified:** 6
+
+## Accomplishments
+- VirusTotalSource searches VT Intelligence API for files containing API key patterns (credential-gated, 4 req/min rate limit)
+- IntelligenceXSource searches IX archive with three-step search/results/content-read flow (credential-gated)
+- URLhausSource searches abuse.ch API for malicious URLs with embedded keys (credentialless, always enabled)
+- All three sources use ciLogKeyPattern for consistent content matching across the recon framework
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: VirusTotal and IntelligenceX sources** - `e02bad6` (feat)
+2. **Task 2: URLhaus source** - `35fa4ad` (feat)
+
+## Files Created/Modified
+- `pkg/recon/sources/virustotal.go` - VT Intelligence API search source
+- `pkg/recon/sources/virustotal_test.go` - httptest mocks for VT (4 tests)
+- `pkg/recon/sources/intelligencex.go` - IX archive search with three-step flow
+- `pkg/recon/sources/intelligencex_test.go` - httptest mocks for IX (4 tests)
+- `pkg/recon/sources/urlhaus.go` - abuse.ch URLhaus tag/payload search
+- `pkg/recon/sources/urlhaus_test.go` - httptest mocks for URLhaus (4 tests)
+
+## Decisions Made
+- VT uses x-apikey header per official API v3 spec
+- IX uses three-step flow: POST search initiation, GET results list, GET file content per record
+- URLhaus uses tag lookup endpoint with payload endpoint fallback for broader coverage
+
+## Deviations from Plan
+
+None - plan executed exactly as written.
+
+## Issues Encountered
+None
+
+## User Setup Required
+None - no external service configuration required.
+
+## Next Phase Readiness
+- Three threat intel sources ready for wiring into RegisterAll
+- VT and IX require API keys via config/env; URLhaus works immediately
+- All sources follow established ReconSource pattern
+
+---
+*Phase: 16-osint-threat-intel-mobile-dns-api-marketplaces*
+*Completed: 2026-04-06*