gossan-intel
Global passive intel for Gossan — pulls IP / domain enrichment from local bulk datasets and configured external sources without ever sending packets to the target.
Sources
- Censys (search.censys.io)
- Shodan
- Passive DNS (CIRCL / DNSDB / PassiveTotal-shaped endpoint)
- GreyNoise
- VirusTotal
- Local bulk SQLite index for offline lookups
Each source is a dyn IntelSource and is registered in
IntelScanner::from_config based on which API keys / endpoints are
present in Config. Missing keys are logged at INFO and the source is
skipped — no scan failure.
Output
Findings are emitted with kind = InfoDisclosure and tagged intel
plus the source name (intel, censys, shodan, etc.) so downstream
correlation can dedupe across providers.
License
MIT