In one sentence
OSINT is intelligence assembled entirely from publicly available sources — DNS and WHOIS records, certificate transparency logs, search engines, social media and breach data — used by attackers to map a target and by defenders to see the same exposure first.
Why it matters
Almost every intrusion starts with reconnaissance, and most of it is OSINT: before touching a target, an attacker maps its domains, subdomains, technologies, exposed services and employees using nothing but public data. It is the cheap, quiet first move — no packets that look like an attack, just lookups anyone is allowed to make. Understanding it is understanding what your adversary knows about you before they begin.
Which is exactly why defenders run the same playbook. Doing your own OSINT sweep shows you the attack surface as the attacker sees it: the forgotten staging subdomain, the dev server with a real certificate, the S3 bucket named after your product, the exec whose conference bio lists the exact tech stack. You cannot defend an exposure you do not know is public.
Passive vs active, and the sources
The critical distinction is passive vs active. Passive OSINT touches only third parties — you query WHOIS, certificate transparency logs, search engines and archives, and the target never sees you. Active recon (port scanning, sending requests to the target's own servers) touches the target directly and is a different legal and detection story. Serious footprinting stays passive as long as possible.
The source categories mirror how infrastructure is described publicly:
- DNS & WHOIS — registration data, name servers, DNS records, historical DNS.
- Infrastructure — Shodan, Censys and certificate-transparency logs (crt.sh) reveal exposed hosts and every hostname a CA ever signed for the domain, which is a superb subdomain-discovery source.
- Threat intel — VirusTotal, AbuseIPDB, reputation and passive-DNS services.
- Web & archives — the Wayback Machine, technology fingerprinting, cached pages that outlive the live site.
The tradecraft is correlation: one subdomain from a certificate log leads to an IP, which leads to a hosting range, which leads to neighbouring assets — each source feeding the next.
Try it yourself hands-on
Footprint a domain the passive way — on a target you own or are authorised to test.
- Open the Recon / OSINT Helper and enter a domain or IP. It generates ready-made links grouped exactly as above — DNS & WHOIS, Infrastructure, Threat Intel, Web Analysis — opening each source (crt.sh, Shodan, Censys, VirusTotal, the Wayback Machine, and more) with your target pre-filled. It is a pivot board: you do the looking, so the recon stays passive and off your own infrastructure.
- Pull the registration and name-server picture with the WHOIS Lookup, then map the domain's DNS with the DNS Mapper to enumerate records and spot subdomains.
- Every subdomain you find from certificate logs is a lead — run the interesting ones through the Subdomain Takeover Checker to see whether any point at an unclaimed cloud resource an attacker could seize. That is the OSINT-to-finding pipeline in miniature.
Result: the same map of your public attack surface an adversary would build — certificate-log subdomains, exposed hosts, stale DNS — produced without sending a single packet at your own servers.
Common misreadings
- Passive does not mean unlimited. Enumerating a target's people shades into privacy and, in some jurisdictions, legal risk. Scope, authorisation and data-handling rules apply even to public data.
- Public data goes stale — and lingers. Archives and cached pages can reveal what a site used to expose; conversely, a "removed" record may still be cached. Corroborate before acting.
- Findings are leads, not conclusions. A hostname in a certificate log may be dead; a Shodan banner may be a honeypot. OSINT points you where to look, it does not prove what is live.