OSINT glossary
Clear, practical definitions of the key terms, techniques and acronyms in open-source intelligence — one page per concept.
75 terms
Core disciplines
10Financial Intelligence (FININT)
Intelligence gathered from the analysis of financial transactions and records — bank flows, corporate filings, and blockchain data — to understand money movement and the people behind it.
arrow_forwardGeospatial Intelligence (GEOINT)
Intelligence derived from imagery and geospatial data — the discipline of working with location.
arrow_forwardHuman Intelligence (HUMINT)
Intelligence gathered from human sources through interpersonal contact.
arrow_forwardImagery Intelligence (IMINT)
Intelligence produced by analysing imagery such as photographs and satellite pictures.
arrow_forwardIntelligence Cycle
The structured process that turns raw information into finished, actionable intelligence.
arrow_forwardMeasurement and Signature Intelligence (MASINT)
Intelligence derived from the technical measurement and distinctive signatures of a target — radar, acoustic, thermal, seismic, or chemical data — rather than from imagery, signals, or human sources.
arrow_forwardOpen-Source Intelligence (OSINT)
The practice of collecting and analysing publicly available information to produce actionable intelligence.
arrow_forwardPriority Intelligence Requirement (PIR)
The specific question an intelligence effort is tasked to answer.
arrow_forwardSignals Intelligence (SIGINT)
Intelligence derived from intercepted signals and electronic communications.
arrow_forwardSocial Media Intelligence (SOCMINT)
The branch of OSINT concerned with extracting insight from social-media platforms.
arrow_forwardTechniques
13Chronolocation
Determining when an image or video was captured from clues within it.
arrow_forwardCryptocurrency Mixer
A service that pools and shuffles funds from many users to obscure the link between the source and destination of a cryptocurrency transaction.
arrow_forwardDigital Footprint
The total trail of data a person or organisation leaves across the internet.
arrow_forwardFootprinting
Systematically mapping the online presence and infrastructure of a target.
arrow_forwardGeolocation
Determining the precise real-world location where an image or video was captured.
arrow_forwardGoogle Dorking
Using advanced search-engine operators to surface information that basic searches miss.
arrow_forwardPivoting
Moving from one piece of information to the next until a single clue becomes a full picture.
arrow_forwardReverse Image Search
Searching by an image rather than text to find where else it appears online.
arrow_forwardSock Puppet
A carefully maintained fake research identity used to investigate without exposing the analyst.
arrow_forwardSteganography
The practice of hiding information inside an ordinary-looking file — such as concealing a message within the pixels of an image — so its very existence is secret.
arrow_forwardUsername Enumeration
Checking a username across many platforms to map every account tied to it.
arrow_forwardWardriving
Mapping wireless networks by moving through an area with a device that records each network's name, location, and security — building a geographic picture of Wi-Fi.
arrow_forwardWeb Scraping
Automatically extracting data from websites at scale.
arrow_forwardIdentifiers & artifacts
8Domain Name System (DNS)
The system that maps human-readable domain names to internet addresses.
arrow_forwardEmail Header
The hidden metadata at the top of every email — including the servers it passed through and originating IP — that reveals how and from where a message was actually sent.
arrow_forwardEXIF Data
Metadata embedded in image files, often including GPS coordinates and device details.
arrow_forwardIndicator of Compromise (IOC)
A piece of forensic evidence — an IP, domain, file hash, or URL — that signals a system may have been breached and can be used to detect or track malicious activity.
arrow_forwardIP Address
A numerical label identifying a device or server on a network.
arrow_forwardMAC Address
A unique hardware identifier assigned to a network interface — used to identify a specific physical device on a local network and, via wireless mapping, to help locate it.
arrow_forwardMetadata
Data about data — hidden information embedded in files, posts, and documents.
arrow_forwardWHOIS
A public record of who registered a domain name and when.
arrow_forwardInfrastructure
7Attack Surface
The sum of an organisation's exposed systems and entry points visible to an outsider.
arrow_forwardAutonomous System (ASN)
A block of IP addresses under the control of a single network operator.
arrow_forwardCertificate Transparency
Public logs of issued TLS certificates that reveal an organisation's domains and subdomains.
arrow_forwardPassive DNS
Historical records of DNS resolutions, letting investigators see which IP addresses a domain has used over time and which domains have shared an IP.
arrow_forwardReverse DNS
Looking up the domain name associated with an IP address.
arrow_forwardSubdomain Enumeration
Discovering the subdomains that belong to a domain to map its full footprint.
arrow_forwardTyposquatting
Registering domains that mimic a legitimate site through small misspellings or look-alike characters, used for phishing, brand abuse, and deception.
arrow_forwardData sources
10Blockchain Explorer
A tool that lets anyone browse a public blockchain — viewing addresses, transactions, balances, and the flow of funds between wallets.
arrow_forwardDark Web
Websites that require special software such as Tor to access.
arrow_forwardData Breach
An incident in which private data is exposed or stolen, often ending up in public leak databases.
arrow_forwardData Broker
A company that aggregates and sells personal information compiled from public and commercial sources.
arrow_forwardDeep Web
Online content that exists but is not indexed by search engines.
arrow_forwardIoT Search Engine
A search engine that indexes internet-connected devices and services by their banners and open ports rather than page content, exposing an organisation's exposed infrastructure.
arrow_forwardKnow Your Customer (KYC)
The regulated process by which banks and services verify a customer's identity — a rich source of identity data that surfaces in investigations and breaches.
arrow_forwardPublic Records
Government and official records that are legally accessible to the public.
arrow_forwardSurface Web
The part of the web indexed by standard search engines.
arrow_forwardWeb Archive
A service that stores historical snapshots of web pages.
arrow_forwardVerification & disinformation
9Astroturfing
The practice of disguising an orchestrated campaign as spontaneous, grassroots public opinion — manufacturing the appearance of broad support that does not really exist.
arrow_forwardCoordinated Inauthentic Behavior (CIB)
The use of networks of fake or deceptive accounts working together to manipulate public debate, mislead people, or artificially amplify a message.
arrow_forwardCorroboration
Confirming a fact by checking it against multiple independent sources.
arrow_forwardDeepfake
Synthetic media in which a person appears to say or do something they never did, generated by AI.
arrow_forwardDisinformation
False information deliberately created and spread to deceive.
arrow_forwardMisinformation
False information shared without the intent to deceive.
arrow_forwardProvenance
The origin and history of a piece of content — where it first appeared and how it travelled.
arrow_forwardSynthetic Media
Any content — image, video, audio, or text — generated or heavily altered by AI.
arrow_forwardVerification
The disciplined process of confirming that information is genuine before relying on it.
arrow_forwardOPSEC & privacy
9Attribution
Determining who is really behind an anonymous account, campaign, or piece of infrastructure.
arrow_forwardCompartmentation
Keeping separate identities and activities strictly isolated so they cannot be linked.
arrow_forwardDoxxing
Publishing someone's private information online, usually to harass or intimidate.
arrow_forwardEgosurfing
Searching for information about yourself online to see what is publicly exposed — the first step in understanding and reducing your own footprint.
arrow_forwardHoneytoken
A piece of bait — a fake credential, file, or tracking link — that silently alerts its owner when someone accesses it, revealing that they were watched.
arrow_forwardMetadata Scrubbing
Removing hidden metadata from files before sharing them.
arrow_forwardOperational Security (OPSEC)
The practice of protecting an investigation and the investigator from exposure.
arrow_forwardTor (The Onion Router)
An anonymity network that routes traffic through multiple encrypted relays, hiding a user's IP and enabling access to .onion sites.
arrow_forwardVirtual Private Network (VPN)
A service that encrypts a user's connection and routes it through a remote server, masking their real IP address and location.
arrow_forwardPractice & analysis
9Application Programming Interface (API)
A structured interface that lets programs request data from a service directly.
arrow_forwardCapture The Flag (CTF)
A competitive exercise used to learn and sharpen OSINT skills.
arrow_forwardChain of Custody
The documented, unbroken record of who handled a piece of evidence, when, and how — establishing that it has not been altered and can be trusted.
arrow_forwardDue Diligence
Researching a person or company to assess risk before a decision or transaction.
arrow_forwardFacial Recognition
Technology that identifies or matches a person from an image of their face.
arrow_forwardLink Analysis
Mapping relationships between people, accounts, and entities as a network graph.
arrow_forwardPretexting
Using a fabricated scenario to manipulate someone into revealing information.
arrow_forwardRate Limit
A cap on how many requests a service will accept in a given period.
arrow_forwardThreat Intelligence (CTI)
Intelligence about cyber threats used to anticipate and defend against attacks.
arrow_forward