OSINT Glossary: 70+ Open Source Intelligence Terms

AbuseIPDB is a community-driven threat intelligence database where users report IP addresses engaged in malicious activities like hacking, spamming, and brute-force attacks. The database provides reputation scores, abuse reports with timestamps and categories, and downloadable blacklists. AbuseIPDB is a valuable resource for network security monitoring and OSINT investigations involving suspicious IP addresses.

Adverse media is news and other public reporting that links a person or organization to negative events such as allegations of fraud, corruption or misconduct, regulatory action, litigation, sanctions or criminal investigations. Adverse-media screening is a standard step in know-your-customer, anti-money-laundering and due-diligence reviews because reporting often surfaces risk before it appears in official records. Adverse media must be read critically: an allegation is not an established fact, reports can conflict, and a name match may refer to a different person. Sound practice organizes coverage into a sourced timeline that separates established events, allegations and conflicting accounts, and treats dedicated legal and sanctions sources as authoritative where they exist.

Agentic OSINT is open-source intelligence in which an AI agent plans and carries out multi-step investigation workflows — source discovery, evidence retrieval, relationship analysis and reporting — against a defined objective, while cited findings link to retained source records and a human investigator reviews, directs and decides. It differs from tool-based OSINT, where the investigator runs one lookup at a time, and from standalone summaries that may lack the case context and retained evidence needed for review. The agent proposes and executes the workflow, but the output is an evidence-linked case rather than a verdict: supported findings, possible matches, contradictions and information gaps stay distinct, and an unsuccessful search does not establish that information is absent. Nexus is an agentic OSINT platform built on this model.

A Basic Bank Account Number (BBAN) is the country-specific portion of an IBAN that identifies the bank and account within a particular nation's banking system. BBAN formats vary by country and include the domestic bank code, branch code, and account number. Understanding BBAN structure helps investigators parse account identifiers and check that an identifier is well-formed when only domestic account details are available.

A beneficial owner is the natural person who ultimately owns or controls a legal entity such as a company, trust, or foundation, regardless of whose name appears on official documents. Nominee directors, shell companies, and complex corporate structures are often used to obscure beneficial ownership. Identifying beneficial owners is a primary goal of financial OSINT and anti-money laundering investigations.

A Bank Identifier Code (BIC), also known as a SWIFT code, is an 8-11 character alphanumeric code that uniquely identifies financial institutions worldwide. BIC codes contain the bank code, country code, location code, and optional branch code. OSINT investigators use BIC lookups to identify the specific bank and branch associated with international wire transfers, verify institution legitimacy, and trace payment flows in fraud investigations.

Bottom Line Up Front (BLUF) is a communication format originating from military intelligence that presents the most important information or conclusion at the beginning of a report, followed by supporting details. BLUF enables decision-makers to quickly grasp key findings without reading entire documents. Intelligence reports and investigative summaries benefit from BLUF structure.

Breach data refers to sensitive information that has been exposed, stolen, or leaked from organizations through security incidents. This data typically includes email addresses, passwords (often hashed), usernames, personal information, and financial details. Investigators use breach data searches to identify compromised credentials, assess exposure risk, and investigate identity theft or fraud cases.

A case file is an organized collection of all documents, evidence, notes, and intelligence related to a specific investigation. Effective case file management includes chronological documentation, source attribution, evidence preservation, and secure storage. Digital case file systems enable searching, tagging, exporting, and collaborative access to investigation materials.

Chain of custody documents how evidence was collected, handled and transferred so a reviewer can assess its history. Nexus supports ISO/IEC 27037-aligned custody records on Pro and Agency when custody is enabled at case creation. Recorded entries include sequential numbers and SHA-256 hash-chain fields. The Chain intact display checks links between entries; it does not independently verify their contents or establish admissibility. Review available records and retain original material before relying on an export.

Competitive Intelligence (CI) is the systematic collection and analysis of information about competitors, market trends, and business environments to support strategic decision-making. CI professionals use OSINT techniques to monitor competitor activities, track industry developments, identify emerging threats, and discover business opportunities through ethical and legal means.

Credential stuffing is an automated cyberattack where stolen username and password combinations from one breach are systematically tested against multiple websites and services. Attackers exploit password reuse behavior to gain unauthorized access to accounts. Understanding credential stuffing helps investigators identify compromised accounts and recommend security improvements.

A data leak is the unintentional exposure of sensitive, confidential, or protected information to unauthorized parties. Unlike breaches caused by external attacks, data leaks often result from misconfigurations, human error, or inadequate security controls. Examples include exposed databases, misconfigured cloud storage, and accidentally published documents containing sensitive information.

A digital footprint is the trail of data left by a person's online activity, including websites visited, emails sent, social media posts, online purchases, and search queries. Digital footprints can be active (deliberately shared content) or passive (data collected without explicit awareness). OSINT investigators analyze digital footprints to build comprehensive profiles of investigation subjects.

The Domain Name System (DNS) is the hierarchical naming system that translates human-readable domain names into IP addresses that computers use to communicate. DNS records include A records (IPv4 addresses), AAAA records (IPv6), MX records (mail servers), and TXT records (text information). DNS reconnaissance is fundamental to network OSINT, revealing infrastructure relationships and service configurations.

A domain registrar is an organization accredited to register and manage domain name reservations on behalf of registrants. Popular registrars include GoDaddy, Namecheap, and Cloudflare. WHOIS records identify which registrar manages a domain, and registrar patterns can reveal connections between domains or provide leads for legal requests for registration information.

Due diligence is a comprehensive investigation or audit conducted before entering into a business relationship, transaction, or agreement. Background checks on individuals, companies, and assets help identify risks including fraud, corruption, regulatory violations, and reputational concerns. OSINT tools accelerate due diligence by aggregating information from diverse public sources.

An edge in graph analysis represents a connection or relationship between two nodes (entities). Edges can be directional (showing flow or hierarchy) or bidirectional, and often include labels describing the relationship type (e.g., 'owns', 'employs', 'registered_by', 'found_in_breach'). Understanding edge semantics is crucial for accurate investigative conclusions.

Entity correlation is the OSINT technique of identifying and mapping relationships between different entities such as people, organizations, domains, IP addresses, email addresses, and phone numbers. By correlating data from multiple sources, investigators build comprehensive profiles showing how entities connect, interact, and relate to each other in complex investigations.

An evidence record is a preserved, attributable item of source material captured during an investigation — the page, document, listing, transcript passage or public record a finding rests on — together with its source location, retrieval time and surrounding context. Evidence records make findings checkable: instead of a bare claim that a profile or filing exists, the investigator can open the material and see what it said when it was retrieved. In Nexus, citations open retained evidence records with available source details and supporting material. Save useful findings or add supported evidence to an Agency graph. Selected case records can be exported to PDF, with available custody entries where enabled; review the output before relying on it.

Evidence-first investigation is an approach in which every finding is tied to an inspectable source before it is presented, and conclusions are stated only as strongly as that evidence supports. Findings are classified rather than blended: supported findings rest on retrieved evidence, possible matches share attributes with the subject but await corroboration, contradictions record where sources disagree, and information gaps mark what could not be established. An unsuccessful search does not establish that information is absent. The method guards against the two common failures of automated research — accepting a summary that cannot be checked, and treating a name or image match as proof of identity. Nexus applies this model across its Skills and conversational investigations.

A finding is a verified piece of intelligence or evidence that has been validated and documented during an investigation. Findings differ from raw data in that they have been analyzed, contextualized, and assessed for reliability. Professional investigators document findings with source attribution, confidence levels, and relevant metadata to support conclusions and legal proceedings.

Geospatial Intelligence (GEOINT) combines imagery, imagery intelligence, and geospatial information to describe, assess, and visually depict physical features and geographically referenced activities. GEOINT enables investigators to analyze location data, map relationships between places and events, and understand the spatial context of intelligence targets.

A graph database is a database management system optimized for storing and querying data as nodes and relationships (edges) rather than traditional rows and tables. Graph databases excel at traversing complex relationship networks, making them ideal for OSINT applications involving entity correlation, fraud detection, and network analysis where understanding connections is paramount.

Human Intelligence (HUMINT) refers to intelligence gathered through interpersonal contact and human sources, as opposed to technical collection methods. HUMINT includes information obtained through interviews, interrogations, conversations with witnesses, informants, and subject matter experts. While OSINT focuses on publicly available data, HUMINT complements it by providing context, verification, and insights that cannot be found in open sources.

An International Bank Account Number (IBAN) is a standardized international numbering system used to identify bank accounts across national borders. IBANs contain country code, check digits, bank identifier, and account number components. Investigators validate an IBAN's structure and check digits, identify the issuing country and bank, and confirm SEPA (Single Euro Payments Area) eligibility in cross-border payment investigations. Validation does not establish that the account exists, who holds it, or its balance.

The International Consortium of Investigative Journalists (ICIJ) is a global network of investigative journalists who collaborate on cross-border investigations. The ICIJ maintains the Offshore Leaks Database, which contains information from the Panama Papers, Paradise Papers, Pandora Papers, and other leaked documents. This database is a critical resource for financial OSINT investigations.

Imagery Intelligence (IMINT) is intelligence derived from the analysis of imagery collected by satellite, aerial photography, or other visual collection platforms. IMINT analysts examine photographs and video to identify military installations, infrastructure, vehicle movements, and environmental changes. Open source IMINT increasingly leverages commercial satellite imagery services accessible to civilian investigators.

An information gap is a question the available evidence does not answer: no source was found, a source exists but is inaccessible, or sources conflict without a way to resolve them. Recording gaps explicitly is a core discipline of evidence-first investigation because it stops assumption from filling the space where evidence should be. An unsuccessful search records a gap; it does not establish that the information, person or activity is absent. Gaps also direct the next step — a different identifier, a regional search, another Skill or an offline inquiry. Nexus results distinguish supported findings, possible matches, contradictions and information gaps, and BLUF situation briefs state their limitations alongside the conclusion.

Investigation notes are structured records created by investigators to document observations, hypotheses, interview summaries, and analytical conclusions during a case. In digital OSINT platforms, investigation notes benefit from end-to-end encryption with modern authenticated ciphers to ensure confidentiality. Advanced implementations include client-side key derivation via PBKDF2, rich text editing with tables and formatting, encrypted file attachments, and integration with entity correlation graphs for linking notes to investigative entities and relationships.

An investigative Skill is a focused, repeatable investigation workflow that answers one defined research question — for example, which public profiles are potentially associated with a username, or what official records exist for a company. A Skill states what it needs from the investigator, what it delivers and what it cannot establish, so results are comparable from case to case. In Nexus, the Skill Library holds 47 investigative Skills in 7 categories covering research, identity, business and risk, media, internet infrastructure, Web3 and relationship analysis. Investigators can start from a Skill, describe their objective in natural language or run a direct lookup, and every Skill result links its findings to inspectable evidence.

An Indicator of Compromise (IOC) is forensic evidence suggesting a security breach or malicious activity has occurred. Common IOCs include suspicious IP addresses, malicious domain names, unusual file hashes, registry modifications, and anomalous network traffic patterns. Security teams and investigators use IOCs to detect threats, scope incidents, and attribute attacks to specific threat actors.

IP geolocation is the process of determining the geographic location associated with an IP address, including country, region, city, and sometimes coordinates. While not precise enough for exact street addresses, IP geolocation provides valuable intelligence about where servers are hosted, where users are accessing services from, and the jurisdictional context of online activities.

IP reputation is a score or classification assigned to an IP address based on its historical behavior and associations. IPs with poor reputation may have been involved in spam, malware distribution, hacking attempts, or other malicious activities. Reputation services aggregate reports from multiple sources to help investigators assess whether an IP address poses a security risk.

A blacklist is a database of IP addresses, domains, or email addresses known to be associated with malicious activity such as spam, malware, phishing, or hacking. Security systems use blacklists to block connections from known bad actors. Investigators query blacklists to assess the reputation of network infrastructure and identify potentially compromised or malicious resources.

Know Your Customer (KYC) is a regulatory requirement for financial institutions and certain businesses to verify the identity of clients and assess their risk profiles. KYC procedures include identity verification, address verification, beneficial ownership determination, and ongoing monitoring. OSINT supports KYC by providing additional verification data and identifying potential red flags.

A Legal Entity Identifier (LEI) is a 20-character alphanumeric code that uniquely identifies legal entities participating in financial transactions worldwide. Mandated by financial regulators after the 2008 crisis, LEIs provide transparency by linking to registration data including legal name, headquarters address, registration authority, and parent company relationships. Financial investigators use LEI lookups to verify corporate identity and uncover ownership structures.

Link analysis is a data analysis technique used to evaluate relationships and connections between entities in a network. Visual link analysis tools like Maltego, i2 Analyst's Notebook, and the Nexus case graph display these relationships as node-and-edge graphs, enabling investigators to identify patterns, key players, and hidden connections that might not be apparent in tabular data.

Malware (malicious software) is any software intentionally designed to cause damage, steal data, or gain unauthorized access to computer systems. Categories include viruses, worms, trojans, ransomware, spyware, and rootkits. Understanding malware helps investigators identify infection vectors, analyze attack patterns, and trace threat actors through malware samples and infrastructure.

An MX (Mail Exchange) record is a DNS record type that specifies the mail servers responsible for receiving email for a domain. MX records reveal which email service a domain uses (e.g., Google Workspace, Microsoft 365, or self-hosted mail servers) and can indicate organizational relationships and infrastructure dependencies.

A nameserver is a DNS server that is authoritative for a domain, containing the definitive DNS records for that domain. Nameserver information in WHOIS records reveals which DNS hosting provider manages a domain's DNS infrastructure. Investigators analyze nameserver patterns to identify common infrastructure across multiple domains and track changes that may indicate ownership transfers.

In graph analysis and entity correlation, a node represents an individual entity such as a person, organization, domain, IP address, email address, or phone number. Nodes contain attributes (properties) describing the entity and form the vertices of the relationship graph. Effective OSINT visualization depends on properly categorizing and displaying different node types.

A nominee director is a person appointed to act as director of a company on behalf of the actual beneficial owner, whose identity remains hidden from public records. Nominee director services are commonly offered by offshore service providers to clients seeking privacy. Investigators trace nominee directors through leaked documents, corporate registry patterns, and professional service firm connections.

An offshore entity is a company, trust, or foundation registered in a jurisdiction outside the owner's country of residence, often in locations offering tax advantages, privacy, or favorable regulatory environments. Common offshore jurisdictions include the British Virgin Islands, Panama, Cayman Islands, and Jersey. While many offshore structures are legal, they can also be used to hide assets or evade taxes.

Operational Security (OPSEC) is the practice of protecting sensitive information from adversaries by identifying critical information, analyzing threats, understanding vulnerabilities, assessing risks, and implementing countermeasures. For OSINT investigators, OPSEC includes protecting research activities from detection, securing collected intelligence, and maintaining anonymity during investigations.

Open Source Intelligence (OSINT) is the collection, analysis, and dissemination of information gathered from publicly available sources. These sources include websites, social media platforms, public records, news articles, academic publications, and government databases. OSINT is a critical discipline used by private investigators, law enforcement agencies, corporate security teams, and intelligence professionals to gather actionable intelligence without requiring classified access or covert methods.

The Panama Papers are 11.5 million leaked documents from Panamanian law firm Mossack Fonseca, published by the International Consortium of Investigative Journalists (ICIJ) in 2016. The leak exposed how wealthy individuals and public officials used offshore entities to hide assets, evade taxes, and launder money. The Panama Papers database remains searchable through the ICIJ Offshore Leaks Database.

The Pandora Papers are 11.9 million documents from 14 offshore service providers leaked to the ICIJ in 2021. This investigation exposed the offshore holdings of world leaders, politicians, billionaires, and celebrities. The Pandora Papers revealed more recent offshore activity than the Panama Papers and expanded the searchable ICIJ Offshore Leaks Database with additional entities and relationships.

The Paradise Papers are 13.4 million documents leaked in 2017 from offshore law firm Appleby and corporate services provider Asiaciti Trust. Published by the ICIJ, these papers revealed offshore investments by multinational corporations, politicians, and high-net-worth individuals. The Paradise Papers contribute to the comprehensive ICIJ Offshore Leaks Database used for financial OSINT investigations.

A password hash is a cryptographic representation of a password created by a one-way mathematical function. Instead of storing passwords in plaintext, secure systems store hashes that cannot be reversed to reveal the original password. Common hashing algorithms include SHA-256, bcrypt, and Argon2. Investigators analyze password hashes in breach data to identify weak passwords and password reuse patterns without accessing the actual passwords.

Password pivot search is an advanced OSINT technique that searches for accounts and identities that breach records associate with a specific password. This method helps investigators map password reuse patterns, surface additional accounts that may belong to a subject, and assess the scope of compromise when a password is known. Password pivot searches use secure hashing to protect query privacy. A match does not establish that the same person controls every account.

A politically exposed person (PEP) is an individual who holds or has held a prominent public function — such as a head of state, senior politician, senior government, judicial or military official, or senior executive of a state-owned enterprise — together with immediate family members and close associates. PEP status is not an accusation. It signals higher exposure to bribery and corruption risk, so regulated businesses apply enhanced due diligence before and during a relationship. A name that matches a PEP list is a possible match until identity is resolved with additional attributes such as date of birth, nationality or role, and a no-match result does not clear a subject.

A pivot in OSINT investigation is the technique of using one piece of discovered information to expand the investigation and uncover additional related data. For example, finding an email address might pivot to discovering associated usernames, which pivot to social media profiles, which reveal real names and locations. Effective pivoting is the hallmark of skilled OSINT analysis.

A possible match is a candidate record, profile, name or identifier that shares attributes with the subject of an investigation but has not been corroborated by independent evidence. A username that equals the subject’s handle, a sanctions-list entry with the same name or an image that resembles a known photo are all possible matches until further evidence confirms or rejects them. A possible match is not proof of identity, ownership, control or wrongdoing; it is a lead to be tested. Evidence-first investigation keeps possible matches visibly separate from verified associations so that a report never presents a similarity as a fact. Nexus Skills label candidate results as possible matches and record the signals that support or contradict them.

Provenance is the documented origin and history of a piece of evidence: where it was found, when it was retrieved, what it looked like at that moment and how it entered the case file. Provenance answers “where did this come from?”, while chain of custody answers “who has handled it since?”. In OSINT, provenance separates a citable finding from an unattributed claim, because a public page can change or disappear after it is retrieved. Provenance is also a common limitation: reverse image search can show where an image appears, but not who created it or where it first appeared. Nexus records provenance for each evidence record and preserves it in PDF case reports.

A relationship graph is a visual map of the entities in an investigation — people, organizations, domains, accounts, wallets and other identifiers — shown as nodes, with the evidenced connections between them shown as edges. A relationship graph makes patterns visible that a table hides: shared infrastructure, common officers, recurring contact details or overlapping usernames. Its value depends on discipline: each edge should trace back to an evidence record, and similarity alone is not proof of association. In Nexus, investigators add evidence from cited findings to a case graph, explore connections between people, organizations and digital identifiers, and include selected graphs in PDF case reports.

Reverse IP lookup is a technique that identifies domain names publicly recorded as hosted on a specific IP address. It reveals shared-hosting relationships that may point to related infrastructure or additional websites associated with a subject. Shared hosting alone does not establish common ownership or control, so each hostname association needs corroboration before it is treated as a link. Reverse IP helps investigators map infrastructure connections between domains and decide which relationships deserve further research.

Sanctions screening is the process of checking a person, organization, vessel, aircraft or cryptocurrency wallet against published sanctions lists and related risk datasets to identify potential matches. Lists are issued by bodies such as the United Nations, the European Union and national authorities, and screening is required in regulated sectors under anti-money-laundering rules. A screening hit is a candidate-level match: it must be resolved against identifying attributes before it is treated as a designation, and a no-match result is not a clearance certificate. Screening reflects list contents at a point in time and should be repeated as lists change. The Nexus Sanctions, PEP and Risk Screening Skill preserves that identity uncertainty in its results.

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that produces a fixed 256-bit (32-byte) hash value from any input data. SHA-256 is widely used for password hashing, digital signatures, and data integrity verification. In OSINT investigations, SHA-256 enables secure password breach checking by hashing the query password before comparing it against breach databases, ensuring the actual password is never transmitted.

A shell company is a corporation that exists on paper but has no significant assets, operations, or employees. Shell companies are legal structures often used for legitimate purposes like holding assets or facilitating mergers, but they can also obscure beneficial ownership, facilitate money laundering, or enable tax evasion. Identifying shell companies is crucial in fraud and corruption investigations.

Signals Intelligence (SIGINT) is intelligence derived from electronic signals and systems, including communications intelligence (COMINT) and electronic intelligence (ELINT). SIGINT involves intercepting and analyzing radio transmissions, radar signals, and digital communications. This discipline is primarily conducted by government agencies and requires specialized equipment and legal authorization.

Social Media OSINT is the collection and analysis of intelligence from social media platforms including Facebook, Twitter/X, LinkedIn, Instagram, TikTok, and others. Investigators extract information such as connections, locations, activities, interests, and sentiments from public profiles, posts, and interactions. Social media intelligence reveals personal details, relationships, and behaviors not available in traditional records.

A sock puppet is a fake online identity created for deceptive purposes, including astroturfing (fake grassroots campaigns), trolling, evading bans, or conducting covert research. In OSINT, investigators create research sock puppets to access platforms without revealing their true identity, while also working to identify sock puppet accounts used by investigation subjects for deception.

Threat intelligence is evidence-based knowledge about existing or emerging threats to cybersecurity, including context, mechanisms, indicators, implications, and actionable advice. Threat intelligence helps organizations understand attacker tactics, techniques, and procedures (TTPs) to proactively defend against cyberattacks. Sources include threat feeds, security vendor reports, and community databases.

Username enumeration is the OSINT technique of systematically searching for a specific username across multiple online platforms and services. By discovering where a username is registered, investigators can map a subject's online presence, find additional profile information, and identify platforms for deeper investigation. Tools automate this process across hundreds of sites.

A verified association is a relationship between an investigation subject and a record, profile, identifier or other entity that is supported by inspectable evidence from public sources, not by similarity alone. A profile becomes a verified association when independent signals — a biography, cross-links between accounts, published contact details or a consistent professional history — corroborate the link and no contradicting evidence outweighs them. A verified association is stronger than a possible match, but it still describes only what the public record supports: it does not by itself establish legal ownership, control or wrongdoing. Nexus records the evidence behind each verified association so that a reviewer, client or court can trace the conclusion back to its sources.

A wallet address is a public alphanumeric identifier on a blockchain that can receive, hold and send cryptocurrency or tokens. An address is derived from a cryptographic key pair, and every transaction involving it is recorded on the public ledger, which makes balances, token holdings, counterparties and activity history open to investigation. A wallet address is pseudonymous: it does not name a legal owner, one person may control many addresses, and exchange-hosted addresses are shared by many users. Activity linked to an address is evidence of transactions, not proof of ownership or wrongdoing. Sanctions lists increasingly include wallet addresses, so sanctions screening and wallet intelligence are often used together.

Web3 identity is the set of public, blockchain-based identifiers through which a person or organization is represented on-chain: wallet addresses, human-readable decentralized names that resolve to those addresses, on-chain labels and any profile records published alongside them. Because anyone can register a name or control many wallets, a Web3 identity is pseudonymous by default. A decentralized name or wallet link is a possible match, not a verified association, until off-chain evidence — an address published on an official site, a corroborated social account or a documented transaction — supports it. Web3 identity research serves fraud, brand-protection and due-diligence work without treating on-chain records as proof of legal identity or current control.

WHOIS is a query and response protocol used to retrieve registration information about domain names, IP addresses, and autonomous systems. WHOIS records typically include registrant contact details, registration dates, nameservers, and registrar information. OSINT investigators use WHOIS lookups to identify domain owners, track registration changes over time, and discover connections between websites.

Zero-knowledge encryption is a data protection architecture where the service provider has no ability to access, read, or decrypt user data. Encryption and decryption occur exclusively on the client device using keys derived from a user-managed passphrase. Even if the server infrastructure is compromised, encrypted data remains unreadable without the user's passphrase. Zero-knowledge encryption is the gold standard for protecting sensitive investigation notes, attorney-client privileged materials, and classified intelligence data.