OSINT reconnaissance — professional lane
OSINT · SOC · Threat intel · Bug bounty · Journalism
Passive collection, correlation, reporting — full toolkit on /osint.
Concept map
Question → Passive sources → Correlate → Report → Remediate
1. Authorization & scope
Written approval, data retention rules, and out-of-scope list before any tool.
2. Passive collection
DNSDumpster, SecurityTrails, crt.sh, theHarvester, HIBP domain search.
3. People & social
Sherlock/Maigret only with policy; focus on impersonation and exec fraud.
4. Infrastructure
Censys, Shodan, urlscan, VirusTotal for IOC enrichment.
5. Report
Source, timestamp, confidence, recommended fix (remove data, MFA, takedown).
Case studies
Collection #1
Billions of creds aggregated — drove HIBP adoption and enterprise credential monitoring.