Before We Begin

Imagine you receive an email from a company you've never heard of. The sender claims to be a recruiter. The email address looks professional. The company website looks real. The LinkedIn profile checks out. But something feels off.

Now imagine you spend 45 minutes searching public information — no hacking, no illegal access, no special tools. Just the internet. And by the end of it, you know that the "company" was registered three weeks ago, the "recruiter's" photo is stolen from a Ukrainian model's Instagram, the website domain was purchased anonymously via a privacy shield, the email server is hosted on infrastructure linked to 14 known phishing campaigns, and the "job offer" in the email is word-for-word copied from a 2021 LinkedIn job post by a legitimate firm.

That's OSINT. That's Open Source Intelligence. And it didn't require a single illegal act.

This is the first post in a weekly series where we'll go deep into the world of OSINT — the tools, the techniques, the methodology, the real-world cases, and the ethical boundaries that separate intelligence professionals from stalkers. Whether you're a security researcher, a journalist, a bug bounty hunter, a corporate investigator, or just someone curious about how much of your digital life is publicly visible — this series is for you.

Let's start from the very beginning.

What Does "Open Source" Actually Mean?

Before anything else, let's clear up the biggest misconception about OSINT. When we say "open source" in this context, we do not mean open-source software. We're not talking about Linux, or GitHub repos, or Python libraries.

In intelligence terminology, "open source" means publicly available. It refers to any information that can be legally obtained without breaking into systems, without purchasing access from criminal marketplaces, and without special government authority.

Open source information includes:

Anything you can find on Google
Public social media profiles and posts
Government databases and public records
Court documents filed in public courts
Company registration databases
Job postings and recruitment data
Academic papers and research
News articles and press releases
Public DNS records and WHOIS data
Satellite imagery (Google Maps, Sentinel Hub)
Radio frequency databases
Patent filings
Web archive data (Wayback Machine)
SSL certificate transparency logs

The defining characteristic is not that the information is free. Some open source intelligence requires paid access to databases. The defining characteristic is that it was made available by the information's owner or exists in a context where the public has a right to access it.

This distinction matters enormously, both legally and ethically. OSINT is what separates a professional investigator from a hacker.

The Official Definition

OSINT is defined by intelligence agencies as:

Intelligence produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.

The key phrases in that definition are worth unpacking:

"Produced" — raw data isn't intelligence. A tweet is data. Understanding that a tweet reveals someone's physical location, confirms their identity, and contradicts their public statement — that's intelligence. OSINT is the process of converting public data into actionable knowledge.

"Collected, exploited, and disseminated" — there's a workflow. Gathering is only one step. The real work is in processing, analyzing, and presenting the findings.

"For the purpose of addressing a specific intelligence requirement" — OSINT doesn't happen in a vacuum. There's always a question you're trying to answer. Who is this person? What does this company actually do? Is this website legitimate? Where was this photo taken? Who owns this IP address? The question shapes the investigation.

A Brief History: OSINT Isn't New

People tend to think of OSINT as an internet-era concept. It's not. The practice of gathering intelligence from publicly available sources is as old as warfare itself.

World War II

The British Broadcasting Corporation (BBC) monitored German and Japanese radio broadcasts throughout World War II. The Foreign Broadcast Intelligence Service (FBIS) in the United States, established in 1941, employed hundreds of analysts whose sole job was to listen to foreign radio and translate, analyze, and report on enemy communications that were broadcast openly into the air.

They were doing OSINT. The enemy was broadcasting the information publicly. The skill was knowing what to listen for and how to make sense of it.

The Cold War

During the Cold War, the CIA established what would eventually become the Open Source Center. Analysts read Soviet newspapers, monitored state broadcasts, studied scientific journals, and tracked public speeches by Soviet officials. A Soviet general boasting of a new military capability in a state media interview was, functionally, a source of intelligence.

The Soviets did the same to the West. Both sides employed large teams of people to do nothing but read open publications from the enemy.

The Gulf War (1991)

CNN's coverage of the Gulf War became a notable case study in open-source intelligence. Military commanders on both sides — and journalists — were watching CNN to understand what was happening on the battlefield in near real time. The cable news broadcast was, in a very real sense, being used as intelligence.

The Digital Era

The internet collapsed the cost of open-source intelligence gathering almost to zero while simultaneously creating an explosion in the volume of available information. Social media, in particular, transformed OSINT. People began voluntarily publishing extraordinary amounts of information about themselves, their locations, their relationships, their habits, and their beliefs.

What once required a team of analysts and access to a library of foreign newspapers can now be done by a single person with a laptop.

The OSINT Cycle: How Intelligence Actually Works

OSINT is not just Googling things. Professional intelligence gathering follows a structured process, often called the Intelligence Cycle. Understanding this cycle is what separates someone who "looked stuff up" from someone who conducted an actual investigation.

Step 1: Planning and Direction

Every intelligence operation starts with a question — called an "intelligence requirement." You need to define precisely what you're trying to find out before you start collecting anything. Vague questions produce vague results.

Bad: "Find out about this company."
Good: "Determine whether this company is legitimate, who actually controls it, whether it has any history of fraud or legal action, and whether its stated address corresponds to a real operating business."

The more specific your requirement, the more focused and efficient your collection will be. Planning also includes deciding what sources you'll use and what the legal and ethical constraints on your investigation are.

Step 2: Collection

This is the phase most people think of when they imagine OSINT — the actual searching and gathering. Collection draws from multiple source categories:

Media sources: news archives, books, magazines, academic papers, broadcast archives

Internet sources: websites, social media platforms, forums, paste sites, code repositories, archived web pages

Public government data: court records, corporate registration databases, property records, patent filings, regulatory filings

Professional and academic publications: scientific journals, industry reports, conference presentations

Commercial data: paid database services that aggregate public records, satellite imagery platforms, data broker services

Grey literature: government reports, think-tank publications, NGO reports, conference proceedings that are technically public but not widely indexed

Good collection practice means working from multiple source types simultaneously and not becoming over-reliant on any single source. If your entire investigation is based on what you find on one social media platform, you're missing most of the picture.

Step 3: Processing

Raw collected data is messy. It contains duplicates, errors, irrelevant information, and things that seem relevant but aren't. Processing means cleaning, organizing, and structuring the data you've collected into a form that can be analyzed.

This might mean building a spreadsheet of all the email addresses associated with a domain, or creating a timeline of social media posts, or plotting physical locations mentioned in public records on a map.

Step 4: Analysis and Production

Analysis is where data becomes intelligence. You take your processed data and start asking: What does this mean? What patterns exist? What's missing? What conflicts with other information? What are the likely explanations for what I'm seeing?

Analysis produces assessments — informed judgments about what the evidence suggests. A good assessment is honest about what it doesn't know and avoids overstating certainty.

Step 5: Dissemination

Intelligence is only valuable if it reaches the right people in the right form at the right time. Dissemination means presenting your findings in a way that serves whoever needs the information.

For a solo bug bounty hunter, this might just mean organizing your recon notes before you start testing. For a corporate investigation firm, it means a formal written report with source documentation. For a law enforcement analyst, it means a briefing document that can be acted on.

Step 6: Feedback

Good intelligence operations include a feedback loop. Did the intelligence help? Were the assessments correct? What would have improved the collection? This refinement improves future operations.

The Five Categories of OSINT Sources

In practice, OSINT professionals think in terms of specific source categories. Knowing these categories helps you make sure you're not missing entire dimensions of an investigation.

1. Social Media Intelligence (SOCMINT)

Social media platforms — Facebook, Instagram, X/Twitter, LinkedIn, TikTok, Reddit, YouTube — are among the richest OSINT sources available. People voluntarily publish location data, relationship networks, daily routines, political opinions, financial status, and personal history.

Social media intelligence requires understanding platform-specific search capabilities, metadata associated with posts, and the way platforms store and expose historical data. The Wayback Machine captures some deleted social content. Third-party archiving services preserve more. Screenshots time-stamped and preserved correctly are admissible in some legal contexts.

Key SOCMINT considerations: platform search operators, username correlation across platforms, metadata analysis from uploaded photos, geotagging data, follower/following network analysis.

2. Technical OSINT

Technical OSINT focuses on digital infrastructure. This includes DNS records, IP addresses, WHOIS data, SSL certificates, web server banners, exposed network services, code repositories, and leaked credentials.

For cybersecurity professionals, technical OSINT is often the first phase of a penetration test or bug bounty investigation. Understanding a target's infrastructure — what they're running, where it's hosted, what's exposed — forms the foundation of any technical security assessment.

Key tools: Shodan, Censys, Zoomeye, SecurityTrails, VirusTotal, crt.sh, WHOIS databases, DNS enumeration tools.

3. Imagery Intelligence (IMINT) from Open Sources

Satellites now provide imagery of most of the Earth's surface at resolutions that were once exclusively military. Services like Google Earth, Google Maps satellite view, Sentinel Hub (European Space Agency), Planet Labs, and Microsoft Bing Maps provide open access to imagery that can be used to verify physical locations, identify facilities, monitor changes over time, and geolocate photographs.

This type of OSINT has become particularly important in conflict-zone verification. Journalists and investigators routinely use satellite imagery to confirm or deny claims about destroyed infrastructure, troop movements, and mass graves.

Key tools: Google Earth Pro (free, downloadable with historical imagery), Sentinel Hub, SunCalc (for shadow-based geolocation), GeoGuessr logic for terrain analysis.

4. Human Intelligence via Open Sources (HUMINT-adjacent)

This is a bit of a grey area, but it includes information gathered from people who make it publicly available — interviews, conference talks, academic presentations, podcast appearances, blog posts, and publicly shared communications.

A CEO who gives a conference talk about their company's new product line is providing open-source intelligence about that company's direction, capabilities, and potentially its technical infrastructure. A security researcher who publishes a blog post about vulnerabilities in a specific software version is providing open-source intelligence to anyone who reads it.

5. Financial and Corporate Intelligence

Corporate registration databases, stock exchange filings (SEC EDGAR in the US, Companies House in the UK, Handelsregister in Germany), property records, court filings, bankruptcy records, tax liens, UCC filings, and grant records form a rich source of financial intelligence about both companies and individuals.

In the UK context (relevant for Moonpig and other UK targets), Companies House provides free access to full company registration records, director history, filed accounts, and shareholder information.

Real-Life Scenarios: OSINT in Action

Let's get concrete. Here are five real-world scenarios where OSINT plays a central role — covering cybersecurity, journalism, corporate due diligence, law enforcement, and personal safety.

Scenario 1: The Bug Bounty Hunter and the Exposed Staging Server

A bug bounty hunter has been invited to test a major UK e-commerce platform. The program scope covers *.company.com. Instead of immediately running vulnerability scanners, the hunter starts with OSINT.

Step 1: Certificate transparency logs at crt.sh reveal 47 subdomains associated with company.com that aren't listed in the scope document. Several have interesting names: staging-api.company.com, dev.company.com, admin-internal.company.com, legacy.company.com.

Step 2: Shodan searches on the company's IP ranges reveal that staging-api.company.com is running software with response headers revealing the exact version of their API framework — a version with three known critical CVEs.

Step 3: A search through GitHub for repositories mentioning the company's internal domain reveals a former employee's personal repo with a config file committed four years ago. The config contains API keys that appear to follow the same naming pattern as current credentials. Even if the keys themselves have been rotated, the naming pattern reveals how the company structures its credentials.

Step 4: LinkedIn reveals that the backend team uses a specific cloud architecture platform, and one engineer wrote a blog post detailing implementation decisions that reveals the database engine and ORM in use.

Step 5: A search through job postings archived on web.archive.org from 18 months ago reveals a posting for a "Senior Django Developer" with "PostgreSQL required" — confirming the backend stack.

The hunter now knows: the staging server is likely in scope (wildcard), the software version with known CVEs, the internal credential naming convention, and the exact tech stack. None of this required touching a single system. All of it came from public data.

Scenario 2: The Investigative Journalist and the Shell Company

A journalist is investigating a luxury property developer who claims to have built affordable housing projects in three countries, but whose social media is full of private jets and superyacht photos. The journalist suspects the "affordable housing" projects are a front for money laundering.

Step 1: UK Companies House search on the developer's main company reveals it was incorporated six months before the first major government contract award. The sole director is a Romanian national with a correspondence address at a registered agent's office in the City of London — meaning the address belongs to a company formation agent that handles hundreds of shell companies.

Step 2: Cross-referencing the director's name against the Panama Papers database (published as a searchable open-source dataset by ICIJ) reveals the same person appears as a beneficial owner of two Panamanian entities incorporated in 2019.

Step 3: Corporate registration searches in the three countries where the "affordable housing" was supposedly built reveal no companies registered to this developer. The claimed projects appear not to exist in any official record.

Step 4: Google reverse image search on the developer's social media photos reveals some of the "project site" photos are stock images purchased from Shutterstock. The superyacht photos, when run through geolocation analysis using marina structures visible in the background, place the yacht in Monaco during a period when the developer was publicly claiming to be "on-site" at a housing project in Kenya.

Step 5: WHOIS history on the developer's company website (retrieved from DomainTools historical records) shows the website was registered two weeks before the first press release announcing £50 million in government contracts.

None of this is a criminal conviction. But it's a compelling body of circumstantial public evidence that informs a publishable investigation — and potentially triggers a formal inquiry.

Scenario 3: The HR Director and the Fraudulent CV

A financial services firm has received an impressive CV from a candidate for a senior risk management role. The candidate claims to have spent seven years at a prestigious Swiss investment bank, has an MBA from INSEAD, and lists three industry certifications.

HR's OSINT investigation:

Step 1: LinkedIn verification. The candidate's LinkedIn shows the same work history. But the account has 47 connections and was created 18 months ago. A seven-year career at a tier-1 investment bank would typically produce hundreds of LinkedIn connections with colleagues and industry peers.

Step 2: INSEAD alumni verification. INSEAD does not publish an alumni directory, but INSEAD alumni typically show up in LinkedIn's alumni network with interconnections. A search of INSEAD alumni in the candidate's alleged graduation year finds no one with the candidate's name. The INSEAD graduation year listed would have required the candidate to have started the MBA at age 19.

Step 3: Industry certification verification. Two of the three certifications listed have publicly searchable verification registries. One name matches. Two do not appear in the registry for the year stated.

Step 4: The Swiss investment bank listed. The bank's press release archive (available on their website) contains no mention of the candidate's name in any client-facing material. The bank's LinkedIn company page shows no past employees with the candidate's name.

Step 5: A reverse image search on the CV headshot returns a result on a Russian social media platform for a person with a different name.

The candidate was never invited to interview. No confrontation, no legal process, no third-party reference check required. OSINT surfaced the fraud in under two hours.

Scenario 4: Geolocation from a Single Photograph

This scenario illustrates one of the most striking OSINT techniques: determining the exact location where a photograph was taken using only the visual content of the image.

A photograph is posted on social media. It appears to show a man claiming to be in London. He is posting what he says are photos of himself "working from home" while on sick leave from his employer. His employer suspects he is actually abroad.

The photograph shows the man at a table. Behind him, through a window, is a cityscape. The sky is visible. Several buildings are partially visible.

The OSINT process:

The distinctive architecture of one building — a curved, blue-glass structure visible in the upper right of the frame — doesn't match anything in London. Using Google Image Search with a crop of the building, and then cross-referencing with architectural databases and urban photography communities, the building is tentatively identified as being in Dubai Media City.

The angle of the sun visible through the window is compared against SunCalc (a free tool that calculates sun position at any location and time). At the time the photo was posted, the sun's angle matches Dubai in late afternoon — not London.

The photo's EXIF metadata (embedded by default by most smartphone cameras unless stripped) was not removed. The GPS coordinates embedded in the image data confirm the location as Dubai, United Arab Emirates.

The photograph was taken in Dubai. The person was not on sick leave. The investigation took 40 minutes.

Scenario 5: The Nation-State Attribution

Bellingcat, perhaps the most famous open-source intelligence organization in the world, has demonstrated repeatedly that OSINT can produce intelligence of a quality previously associated only with state intelligence agencies.

Following the 2018 poisoning of Sergei Skripal in Salisbury, UK, two Russian men appeared on Russian state television claiming to be tourists who had visited Salisbury to see its famous cathedral. British authorities identified them as GRU officers under cover names Alexander Petrov and Ruslan Boshirov.

Bellingcat, working entirely with open-source materials, went further. Using Russian passport data leaked to a Telegram channel (itself a publicly accessible channel), they cross-referenced the cover identities against patterns in Russian passport number issuance. The cover passports had consecutive numbers with real passports registered in Moscow around the same time — a pattern consistent with state-issued cover documents.

Using open-source aviation records, hotel records scraped from public booking sites, and CCTV footage published by British police, Bellingcat traced the two men's movements in detail.

They then identified the real individuals behind the cover names. One was identified as Colonel Anatoliy Chepiga, a decorated GRU colonel who had received Russia's highest state honor. The other was identified as Dr. Alexander Mishkin, a GRU military doctor. A third GRU officer, Denis Sergeev, was identified as supervising the operation.

All of this was accomplished using publicly available information. No government databases were hacked. No classified documents were leaked. The investigation was conducted by a small team using internet-connected laptops.

Common OSINT Misconceptions

Let's address some of the myths that circulate about open-source intelligence.

Myth 1: "OSINT is just Googling things."

Google is one tool among hundreds. OSINT draws on specialized databases, legal records, corporate filings, satellite imagery, metadata analysis, network infrastructure data, and dozens of other sources that Google doesn't index or surfaces poorly. The skill in OSINT is knowing which sources to consult for which questions, and how to synthesize information from multiple disparate sources into a coherent picture.

Myth 2: "Everything online is fair game."

Legally, OSINT operates in a more complex space than "if it's on the internet, I can use it." Terms of service, data protection laws (GDPR in the EU/UK, CCPA in California), computer fraud statutes, and harassment laws all interact with OSINT practice. Information being publicly visible does not necessarily mean you have unlimited rights to collect, aggregate, process, or publish it. Responsible OSINT practice requires understanding the legal framework in your jurisdiction.

Myth 3: "OSINT requires expensive tools."

Some of the most powerful OSINT can be done with free tools: Google Advanced Search, crt.sh, Shodan's free tier, Have I Been Pwned, Google Earth, the Wayback Machine, WHOIS databases, crt.sh, and LinkedIn's basic search. Paid tools accelerate and automate, but they're not prerequisites.

Myth 4: "OSINT is always accurate."

Open sources contain errors, deliberate misinformation, outdated information, and data that has been manipulated. A core OSINT skill is source evaluation — assessing the reliability and credibility of information and corroborating findings across multiple independent sources before drawing conclusions. The intelligence cycle's analysis phase exists precisely because raw collected data is unreliable.

Myth 5: "Only governments and big companies use OSINT."

Journalists, private investigators, HR professionals, academics, activists, security researchers, and ordinary people use OSINT regularly. Any time someone searches a person's name before a first date, checks a company's reviews before making a purchase, or verifies a news story by looking at source material — they're doing a rudimentary form of open-source intelligence.

The Ethics of OSINT

No serious treatment of OSINT can skip the ethics. This is especially true because the techniques that make OSINT powerful — aggregating individually innocuous pieces of information into revealing profiles — can cause genuine harm when misused.

The Aggregation Problem

Individually, knowing someone's name is harmless. Knowing their employer is harmless. Knowing their general neighborhood is harmless. Knowing their gym is harmless. Knowing their car is harmless. But combining all of these into a single profile creates something that could enable stalking, harassment, targeted social engineering, or physical harm.

This is called the aggregation problem, and it's why privacy advocates are concerned about data brokers even when those brokers only work with publicly available data. The harm comes from the combination, not from any individual data point.

Responsible OSINT practitioners think carefully about whether their aggregation of public data serves a legitimate purpose and whether the potential for harm is proportionate to that purpose.

Legitimate Purpose

The clearest ethical test for any OSINT activity is: what is the legitimate purpose, and does that purpose justify the investigation?

Investigating whether a potential business partner has a history of fraud? Legitimate. Investigating a suspect in a criminal matter for law enforcement? Legitimate (with appropriate legal authority). Identifying the source of online harassment against a vulnerable person? Potentially legitimate, requires careful judgment. Building a profile of an ex-partner's daily routine? Not legitimate. Investigating a journalist who wrote critically about your organization? Not legitimate.

The legitimate purpose test sounds simple but can become genuinely difficult in edge cases. Professional OSINT practitioners consult ethics guidelines from organizations like the Open Source Intelligence Foundation (OSIF) and the investigations desk standards of established news organizations.

The "Could I Publish This?" Test

For investigative applications, a useful heuristic is: could I publish everything I did in this investigation — every search, every source consulted, every step — and would a reasonable person consider it appropriate? If the answer is no, reconsider.

Legal Compliance

Different jurisdictions have different laws about what you can do with publicly available information. In the UK, the Data Protection Act 2018 (implementing GDPR) places obligations on how personal data can be processed even if that data is publicly available. Scraping LinkedIn's data, for example, has been the subject of ongoing legal dispute regardless of the public nature of the profiles. In the US, the Computer Fraud and Abuse Act has been interpreted in ways that affect even public website scraping.

Know the law in your jurisdiction before you conduct an OSINT investigation professionally.

Essential OSINT Tools for Beginners

You don't need to buy anything to start learning OSINT. Here's a foundational toolkit that's either free or has a meaningful free tier.

Search and Discovery

Google Advanced Search — Master the operators: site:, filetype:, inurl:, intitle:, "exact phrase", -exclusion. These operators let you filter Google results in ways the basic search box doesn't expose.

DuckDuckGo — Useful for searches where you don't want your search history affecting results, and for the !bang operators that let you search specific sites directly.

Yandex — Russian search engine with notably better reverse image search than Google, particularly for photographs of people.

Bing — Often indexes content that Google doesn't, particularly older or less-trafficked pages.

People and Identity

Sherlock — Open-source tool that checks a username across hundreds of social media platforms simultaneously. Extremely useful for username correlation.

Have I Been Pwned (haveibeenpwned.com) — Check whether an email address appears in known data breaches.

LinkedIn — Essential for professional history verification, employee enumeration, and organizational mapping.

Wayback Machine (web.archive.org) — Access historical versions of websites, including ones that have been taken down or significantly modified.

Technical Infrastructure

Shodan (shodan.io) — The most widely used search engine for internet-connected devices. Searches by IP, ASN, hostname, product, version, and many other parameters. Free tier available.

Censys (censys.io) — Similar to Shodan, with different indexing approaches. Often surfaces complementary results.

crt.sh — Certificate transparency log search. Search by domain to discover all SSL/TLS certificates issued for subdomains. Invaluable for subdomain discovery.

DNSDumpster (dnsdumpster.com) — Free domain research tool providing DNS records, MX records, and a visual map of domain infrastructure.

SecurityTrails — Historical DNS data, WHOIS records, and subdomain enumeration. Free tier available.

VirusTotal — Scan files, URLs, IP addresses, and domains against dozens of security vendors. Invaluable for malware investigation and domain reputation.

Corporate and Legal Records

UK Companies House (companieshouse.gov.uk) — Free access to complete records for all UK-registered companies including directors, filed accounts, and shareholder information.

SEC EDGAR (sec.gov/edgar) — US publicly traded company filings. Complete financial disclosure, insider trading reports, proxy statements.

OpenCorporates (opencorporates.com) — Aggregates corporate registration data from dozens of jurisdictions worldwide.

Imagery and Geolocation

Google Earth Pro — Free to download. Provides historical satellite imagery, high-resolution imagery, and measurement tools. Critical for geolocation and imagery analysis.

SunCalc (suncalc.org) — Calculate the position of the sun at any location, date, and time. Used to verify or refute claimed photograph locations using shadow angles.

Sentinel Hub (sentinel-hub.com) — European Space Agency satellite imagery, particularly useful for monitoring changes in specific locations over time.

Where to Go From Here

If you've made it this far, you now have a solid conceptual foundation in OSINT. The next step is to start using the tools.

Pick one of the scenarios from this post and try to replicate it. Start with something simple: take a company you're familiar with and try to map their digital infrastructure using only crt.sh, Shodan, and DNS records. Or take a public figure and see how much you can learn about their professional history using only LinkedIn, Google Advanced Search, and the Wayback Machine.

The only way to develop OSINT skills is to practice them on real targets — with real constraints. For security researchers, that means targets where you have authorization (your own infrastructure, or authorized programs). For everyone else, it means targets where investigation is clearly in the public interest or in your personal interest (your own data, for example).

Practice your technique. Develop your workflow. And read widely — the OSINT community is active and generous. Bellingcat publishes detailed writeups of their investigations. Trace Labs runs OSINT competitions for missing persons cases. The OSINT Framework (osintframework.com) is an exhaustively curated directory of tools organized by intelligence category.

The information is all out there. The question is whether you know how to find it.

Quick Reference: OSINT Vocabulary

Before you go, here are the core terms you'll encounter as you go deeper into the field:

OSINT — Open Source Intelligence. Intelligence derived from publicly available information.

SOCMINT — Social Media Intelligence. The OSINT subcategory focused specifically on social media platforms.

IMINT — Imagery Intelligence. Intelligence derived from photographs and satellite imagery.

SIGINT — Signals Intelligence. Intelligence from communications signals. When derived from open sources (publicly broadcast radio, unencrypted transmissions), this overlaps with OSINT.

HUMINT — Human Intelligence. Intelligence from human sources. Where people publish their own information publicly, this overlaps with OSINT.

Geolocation — Determining the real-world geographic location of a person, object, or photograph using visual and contextual clues.

Pivoting — The technique of using one piece of discovered information as the basis for the next search. An email address pivots to a username, which pivots to a forum profile, which pivots to an IP address.

Pattern of Life — Building a picture of a subject's routines, habits, locations, and associations over time. Used in both intelligence and stalking — the purpose determines the ethics.

Operational Security (OPSEC) — The practice of protecting your own investigation from detection. Important when investigating subjects who might respond adversarially to being investigated.

Intelligence Requirement — The specific question or set of questions an intelligence investigation is designed to answer.

Source Evaluation — Assessing the reliability, credibility, and recency of an intelligence source. Critical because open sources contain significant amounts of false, outdated, and manipulated information.

This post is part of the OSINT Series — a deep dive into open-source intelligence for security researchers, investigators, journalists, and curious people.

All techniques described in this series are for educational purposes and should only be applied to targets where you have legal authorization or where investigation is in clear public interest. Know the law in your jurisdiction.

Series: The OSINT Files
Episode: 1 of ongoing
Author: security-news.net | pentest.day