OSINT & Privacy Glossary

Short, plain-language definitions for the OSINT and privacy terms used across the learn guides and the tools directory. Jump to a letter below, or use your browser's search to find a specific term.

A · B · C · D · E · F · G · H · I · K · L · M · N · O · P · R · S · T · U · V · W

A

Active reconnaissance

Gathering information by directly interacting with a target’s systems or accounts, such as sending a request to a server or visiting a tracked link. Unlike passive reconnaissance, it carries a chance of being detected.

ADS-B (Automatic Dependent Surveillance–Broadcast)

A system that aircraft use to broadcast their identity, position, altitude, and speed. Ground receivers pick up these broadcasts and aggregate them into public flight-tracking sites.

AIS (Automatic Identification System)

A system that ships use to broadcast their identity, position, course, and speed, originally intended for collision avoidance. Receivers around the world pick up these broadcasts and feed them into public vessel-tracking sites.

Alt account

A secondary account run by the same person as their main account, usually to compartmentalize activity or preserve some privacy. This is distinct from a sock puppet, which is built to impersonate a separate, fictitious identity.

ASN (Autonomous System Number)

A unique identifier assigned to a network operator, such as an internet service provider, hosting company, or large organization, that controls a block of IP addresses and routes traffic for them on the internet.

Attack surface

The complete set of points where an unauthorized party could try to gain access to a system or extract data from it. Applied to a person, it means every account, device, and piece of exposed information that could be used against them.

B

Connecting to a networked service, such as a web or mail server, and reading the identifying information it returns — typically the software name and version — to fingerprint what it is running.

C

Canary token

A unique, trackable piece of data, such as a fake file, link, or credential, planted so that an alert fires the moment it is accessed. It reveals that an unauthorized access or breach happened, without needing to detect the intrusion itself.

Canvas fingerprinting

A browser fingerprinting technique that draws a hidden image or text using the HTML5 canvas element. Because the result renders with tiny differences depending on the device’s graphics hardware and software, it can help distinguish one browser from another without using cookies.

CCPA (California Consumer Privacy Act)

A California state law that grants residents rights over the personal information businesses collect about them, including the right to know what has been collected, to request its deletion, and to opt out of its sale.

Certificate transparency

A public log system that records every publicly trusted TLS/SSL certificate issued for a domain. These logs can be searched to discover subdomains or infrastructure that a site owner never intended to publicize.

Chain of custody

A documented, unbroken record of who has handled a piece of evidence and how, used to establish that it has not been altered or tampered with since it was collected.

Chronolocation

Estimating when a photo or video was taken, as opposed to where, using visual clues such as shadow angles, weather, foliage, or a visible clock or event.

Credential stuffing

An automated attack that tries username and password pairs stolen from one data breach against other, unrelated services, exploiting the fact that many people reuse the same password across sites.

Cross-referencing

Comparing information found in one source against another to confirm it is accurate, find inconsistencies, or link two records together as referring to the same person or thing.

D

Dark web

The part of the internet that is only reachable through specific software, most commonly Tor, and is not indexed by conventional search engines.

Data breach

An incident in which data held by an organization is accessed, copied, or removed by someone who was not authorized to do so.

Data broker

A company that collects personal information from public records, purchases, and other sources, then compiles and sells profiles or contact information about individuals.

Data leak

Data that becomes exposed or publicly accessible, often through a misconfiguration or accidental publication, without necessarily involving an attacker breaking in.

Deep web

The much larger part of the internet that is simply not indexed by search engines, including content behind logins, private databases, and paywalled pages. It is distinct from the dark web, which requires special software to reach.

Deepfake

Synthetic media, generated or altered using machine learning, that depicts a person saying or doing something they did not actually say or do.

Digital footprint

The total trail of data a person leaves behind through their online activity, including things they posted deliberately and things recorded about them by other people or systems without their direct involvement.

DNS (Domain Name System)

The system that translates human-readable domain names into IP addresses. Its records, such as A, MX, TXT, and NS records, can reveal hosting providers, mail services, and other infrastructure relationships behind a domain.

Doxxing

Publishing someone’s private or identifying information, such as a home address, workplace, or phone number, publicly — usually to harass, intimidate, or enable others to target them.

E

Email verification / account existence check

Determining whether an email address is registered with a given service, often by exploiting sign-up or password-reset forms that respond differently depending on whether the account exists.

Entity resolution

The process of determining whether different records, possibly from different sources or with slightly different details, refer to the same real-world person, organization, or thing.

Entropy (password)

A measure, usually expressed in bits, of how unpredictable a password or piece of information is. Higher entropy means more possible combinations an attacker would need to try before guessing it.

EXIF data

Exchangeable Image File Format metadata embedded in photos by cameras and phones, which can include the device model, timestamp, camera settings, and sometimes GPS coordinates of where the photo was taken.

F

Fingerprinting (browser/device)

Identifying or tracking a specific browser or device based on the unique combination of its settings and characteristics, such as screen size, fonts, and installed plugins, rather than through cookies.

Footprinting

The process of systematically collecting information about a target, whether a person or an organization, to build a picture of their infrastructure, accounts, or public presence.

G

An EU law that governs how organizations collect, use, and store the personal data of people in the EU, and grants individuals rights such as access to and deletion of the data held about them.

Geo-IP

The practice of estimating a device’s physical location based on its IP address. It is typically accurate to a city or region, not a precise street address.

Geofencing

Defining a virtual geographic boundary so that an action, such as an alert or a data request, is triggered when a device enters or leaves that area.

Geolocation

Determining or estimating the physical location associated with a piece of data, such as a photo’s visible background, a device’s IP address, or coordinates embedded directly in a file.

Google dork / dorking

Using a search engine’s advanced operators, such as site:, filetype:, or intitle:, to find pages or files that are indexed but not easily surfaced by an ordinary search.

H

Hash / hashing

Running data through a one-way mathematical function that produces a fixed-length string, the hash. The same input always produces the same hash, but the original data cannot practically be recovered from it. Hashing is used to store passwords and verify file integrity.

Have I Been Pwned (HIBP)

A widely used free service that lets people check whether their email address or phone number appears in known, publicly circulated data breaches.

Honeypot

A decoy system, account, or piece of data set up to attract and detect unauthorized access attempts, without holding any real value of its own.

I

IMSI (International Mobile Subscriber Identity)

A unique number that identifies a SIM card’s subscriber on a mobile network. It is distinct from the phone number, and from the IMEI (which identifies the physical handset) — swap the SIM into another phone and the IMSI stays the same. It is used by carriers, and by interception equipment known as IMSI catchers, to identify a specific SIM/subscriber.

IOC (indicator of compromise)

A piece of forensic data, such as a file hash, IP address, or domain name, that suggests a system has been compromised or is associated with known malicious activity.

IP address

A numerical label assigned to a device on a network. It can be used to approximate a device’s geographic location and identify the internet service provider it connects through.

K

k-anonymity

A property of a dataset in which each record is indistinguishable from at least k-1 other records on the attributes that could identify someone. It is one way to measure how well a supposedly anonymized dataset actually protects individuals.

L

Link analysis

A technique for visualizing and analyzing relationships between people, organizations, or pieces of data, typically represented as a network of connected nodes and edges.

M

MAC address

A unique hardware identifier assigned to a network interface, such as a Wi-Fi or Bluetooth chip. Because it does not normally change, it can be used to track a specific device across networks unless the address is randomized.

Metadata

Data about data: information describing a file or record, such as its author, creation date, originating device, or location, rather than its visible content.

Metadata scrubbing

Removing hidden metadata, such as EXIF data, author names, or document revision history, from a file before sharing it, to prevent that information from being exposed.

N

Node and edge

In a link-analysis graph, a node represents an entity, such as a person, account, or organization, and an edge represents a relationship or connection between two nodes.

O

Onion service

A website or service reachable only through the Tor network, using a .onion address rather than a conventional domain, which conceals the server’s real location.

OPSEC (operations security)

The practice of controlling what information about your activities, identity, or plans is exposed, so it cannot be used against you. Originally a military discipline, it is now applied to personal privacy and investigative work alike.

OSINT (open-source intelligence)

Information gathered from sources that are publicly available, rather than obtained through hacking, deception, or insider access. The techniques originate in intelligence and journalism work but are now widely used at a much smaller, personal scale.

P

Passive reconnaissance

Gathering information about a target without directly interacting with their systems or accounts, such as reading public records or archived pages, so the target has no way of detecting that it happened.

Password manager

Software that generates and stores unique, complex passwords for each account, so a person only needs to remember one master password, or use a device-level unlock, to access them all.

Password spraying

An attack that tries one or a few common passwords against many different accounts, rather than trying many passwords against a single account, to avoid triggering account-lockout defenses.

People-search site

A website that aggregates public records, data-broker feeds, and other sources into searchable profiles of individuals, typically including addresses, relatives, and phone numbers. Most offer an opt-out process to have a listing removed.

Phishing

Sending fraudulent messages, typically emails or texts, that impersonate a trusted sender to trick a person into revealing credentials, clicking a malicious link, or sending money.

PII (personally identifiable information)

Any information that can be used, alone or combined with other data, to identify a specific individual, such as a full name, home address, national ID number, or biometric data.

Pivot / pivoting

Moving from one piece of known information to a new one by following a connection between them — for example, going from a username to the email address tied to the same account.

Provenance

The origin and subsequent history of a piece of content or data: where it first appeared, who created it, and how it has been copied or altered since.

Proxy server

An intermediary server that relays requests between a client and the internet. It can be used to hide the origin IP address of a request, bypass geographic restrictions, or filter traffic.

R

Redaction

Permanently removing or obscuring sensitive information from a document or image before it is shared, so that it cannot be recovered — distinct from simply covering it, which can sometimes be reversed.

Reverse DNS

Looking up the domain name associated with a given IP address, the inverse of an ordinary DNS lookup. It can reveal what server or organization operates that IP address.

Reverse image search

Searching using an image instead of text, to find where else that image, or a similar one, appears online. It is often used to identify a person, location, or the original source of a photo.

Right to be forgotten

A legal right, most firmly established under EU law through the GDPR, allowing individuals to request that certain personal information about them be removed from search results or a data holder’s records under specific conditions.

Robots.txt

A text file that a website can publish to tell web crawlers which parts of the site they are permitted, or asked not, to index. It is a request that well-behaved crawlers honor, not an enforced restriction.

S

Salt (cryptography)

Random data added to a password before it is hashed, so that identical passwords produce different hashes. This defeats precomputed lookup-table attacks against stored password hashes.

Selector

A specific piece of identifying information, such as a username, email address, phone number, or photo, used as a starting point or search term in an investigation.

Sextortion

A form of extortion in which someone threatens to release sexual images or information about a victim unless they are paid or otherwise coerced.

SHA-1

A cryptographic hash function that produces a 160-bit hash. It was once widely used for passwords and file integrity, but is now considered broken for security purposes because researchers have demonstrated practical collision attacks against it.

SIM swapping

An attack in which someone tricks or bribes a mobile carrier into transferring a victim’s phone number onto a SIM card the attacker controls, letting them intercept calls and SMS-based verification codes.

Manipulating a person, rather than a system, into divulging information or taking an action that undermines their own security, such as revealing a password or granting access.

Sock puppet

A fake online identity, typically with its own name, photos, and history, created to interact with a target or platform without revealing the real person behind it.

Subdomain enumeration

Systematically discovering the subdomains that exist under a given domain, often revealing test environments, internal tools, or forgotten services.

Suppression / opt-out

The process of requesting that a data broker or people-search site remove your information from its public listings and, ideally, from its underlying database as well.

T

Threat intelligence

Collected and analyzed information about existing or emerging threats, such as attackers, malware, or tactics, used to inform security decisions.

Threat model / threat modeling

An analysis of who might want to target a specific person or organization, what resources they have, and what the most likely and most damaging attack paths are, used to prioritize which defenses actually matter.

TLS/SSL certificate

A digital certificate that verifies a website’s identity and enables encrypted, HTTPS connections. Its issuance is recorded in certificate transparency logs.

Tor

Free software and a volunteer-run network that routes internet traffic through multiple relays to conceal a user’s location and identity. It is also used to access .onion, dark-web, services.

Two-factor authentication (2FA)

A login process that requires two different types of proof of identity, typically something you know (a password) and something you have (a code from an app or a physical key). It makes an account harder to access even if the password is stolen.

U

Username enumeration

Checking whether a given username is registered on a platform, often by observing subtle differences in the site’s response, which can be used to find every platform a person uses the same handle on.

V

Verification (fact-checking)

The process of independently confirming that a piece of information, image, or claim is accurate and correctly attributed before relying on it or publishing it.

VPN (virtual private network)

A service that routes a device’s internet traffic through an intermediary server and encrypts it, hiding the user’s real IP address from the sites they visit and hiding their traffic from their local network or ISP.

W

Wayback Machine / web archive

A service, most notably the Internet Archive’s Wayback Machine, that stores snapshots of web pages over time, allowing someone to view a site’s earlier content even after it has changed or been taken down.

WHOIS

A public lookup protocol and database that shows registration information for a domain name, such as the registrar and registration dates, and, unless redacted by a privacy service, the registrant’s contact details.