Information & Contact Disclosure (OSINT)

What it is

Collects the contact and personnel intelligence a site publishes (staff and role email addresses, phone numbers, social profiles, postal address, author names) and reports it as social-engineering attack surface, with guidance to reduce exposure. VibeSec gathers this defensively and never performs social engineering.

How attackers abuse it

Missing or weak email records (SPF, DKIM, DMARC) let anyone send email that looks like it came from your domain, which is perfect for phishing your users and partners.

Attacker playbook

1. 1Check the domain's DNS for SPF, DKIM, and DMARC records.
2. 2If they are missing or weak, craft an email spoofing your domain.
3. 3Send phishing that passes basic checks because nothing rejects it.

How VibeSec detects and confirms it

VibeSec checks for this with a passive, read-only scan that is safe to run on any site. We use VibeSec native and base the finding only on what your site already exposes publicly.

If this is in your report: how to fix it

• Publish an SPF record listing your real senders.
• Set up DKIM signing with your email provider.
• Add a DMARC policy and move it to reject once you have confirmed legitimate mail passes.