OSINT Glossary: Investigation Terms Defined

A

Active collection: Collection that requires interacting with a subject or a system in a way that could be noticed, such as messaging, following or requesting access. Aldervane does not engage subjects. Our collection is observational, as set out in our standards.
Adjudication: The decision an organization makes about a person after screening: whether a discrepancy matters for the role, and what to do about it. We report discrepancies and their evidence. The client's adjudicator decides, after the person has had the chance to respond. See screening and vetting.
Adverse media screening: Searching news, court reporting and other published sources for negative information about a person or company, such as allegations of fraud, corruption or sanctions breaches. Useful at scale, but it finds only what has already been reported and cannot judge whether an allegation is true.
Analysis of competing hypotheses: A structured analytic technique in which analysts list every plausible explanation and score each item of evidence by how well it discriminates between them, rather than how well it fits a favored conclusion. Used on every Aldervane attribution.
Asset-aligned monitoring: Monitoring in which relevance is decided by distance from, and impact on, a client's named sites, routes and people, and not by keywords. An event matters because it is two kilometers from a facility, not because it mentions a country.
Attribution: A judgment that a specific person, group or organization is responsible for specific activity. It is the most consequential claim an intelligence report can make, and we hold it to a written standard of proof.

B

Beneficial owner: The natural person who ultimately owns or controls a company or asset, as distinct from the legal owner named in a registry. Also called the ultimate beneficial owner. See our guide to nominee structures.
Blockchain analysis: Tracing the flow of cryptocurrency across a public ledger and grouping addresses likely to be controlled by the same party. Every transaction is visible, but identifying who controls an address usually requires combining ledger analysis with off-chain evidence or legal process.
Burner account: An account created for a single purpose and abandoned afterwards, typically to threaten, harass or test without exposing a main identity. Burners usually fail through reused images, usernames, devices or writing habits.

C

Certificate transparency: Public, append-only logs of the security certificates issued for websites. Because certificates are often requested in batches, the logs can reveal groups of domains set up by the same operator, as in our infrastructure pivoting field note.
Chain of custody: The documented record of who collected, handled and transferred an item of evidence, and when. A complete chain lets a court rely on the item being unchanged since it was collected. See evidence handling for OSINT.
Chronolocation: Establishing when a photo or video was taken, using evidence such as the length and direction of shadows, weather, lighting, visible events and the earliest known appearance of the file online.
Circular reporting: When one original claim is repeated by many outlets or accounts, creating the false impression of independent confirmation. Analysts count origins, not mentions.
Clustering heuristics: Rules used in blockchain analysis to group addresses likely to be controlled by one party, such as common-input ownership, where addresses are spent together in a single transaction, and change-address detection.
Confidence level: A statement of the quality of the evidence behind a judgment, expressed as high, moderate or low. It is distinct from probability, which states how likely the judgment is to be true.
Coordinated inauthentic behavior: Networks of accounts working together to mislead audiences about who is speaking and how many people agree, usually through fake or concealed identities. See seven signals that separate a network from a crowd.
Corporate registry: An official register of companies in a jurisdiction, typically recording incorporation, officers, shareholders and filings. Coverage and public access vary widely, from detailed ownership registers to almost nothing.

D

Dark web: Parts of the internet reachable only through anonymity networks, hosting forums, markets and leak sites that are deliberately hard to locate or attribute. See our dark web intelligence service.
Deep web: Content that is online but not indexed by search engines, such as registries, court dockets, databases and pages behind search forms. Much of the most valuable open-source material sits here, and none of it is secret.
Defanging: Altering a link, domain or network address in a report so that it cannot be clicked or resolved by accident, for example by writing a domain with its dot in brackets. Standard practice when sharing malicious indicators.
Digital footprint: The total trace a person or organization leaves online, including accounts, posts, registrations, mentions and metadata. Footprint reviews underpin both investigations and exposure reduction for principals.
Disinformation: False or misleading information spread deliberately to deceive. Compare misinformation, which is spread without intent to deceive.
Diversion: The movement of goods to a destination, user or purpose other than the one declared, often to evade sanctions or export controls. It tends to show in trade data as new intermediaries, unusual routes and product descriptions that do not match.
Doxxing: Publishing private or identifying information about a person, such as where they live or details about their family, usually to intimidate them or to enable harassment by others.
Due diligence: Research into a counterparty, investment or senior hire before a commitment is made, covering ownership, integrity, litigation, sanctions exposure and reputation. See our due diligence service.

E

Employment fraud: Obtaining a job under a false or borrowed identity, or passing the work to someone the employer has never vetted. In remote hiring the identity documents are often genuine, which is why document checks alone do not detect it. See The candidate who is not there.
Entity resolution: Determining whether different records, accounts or identifiers refer to the same real-world person or organization. It is the foundation of link analysis and the stage at which most attribution errors begin. Our analysts use Aldervane Resolve for this work.
Estimative language: A fixed vocabulary of probability terms, each mapped to a numerical range, so that a word such as "likely" means the same thing in every report. Ours runs from remote (1 to 5 percent) to almost certain (95 to 99 percent).
Event verification: Confirming that a reported event happened where and when it is claimed to have happened, before anyone acts on it. Our standard requires a claim to pass five tests: origin, place, time, independent corroboration and consistency. See Verified, not viral.
EXIF metadata: Technical data embedded in image files by cameras and phones, which can include capture time, device model and location. Many platforms strip it on upload, so original files are often more valuable than shared copies.

F

Finished intelligence: Analysis that has been evaluated, structured and written to answer a decision maker's question, with sources and confidence stated. The opposite of raw data or unverified alerts.
Forced labor indicators: Observable signs associated with forced labor, such as debt from recruitment fees, retention of identity documents, restricted movement and isolation. From open sources we report which indicators are documented at a site. Whether they meet a legal threshold is a question for counsel and the authorities.

G

Geolocation: Determining where a photo or video was taken by matching visible features, such as terrain, buildings, signage and road layouts, against maps, satellite imagery and street-level photography.
Grey literature: Material published outside commercial and academic channels, such as government reports, court documents, trade publications, conference papers and corporate filings. Often authoritative and rarely well indexed.

H

Hash value: A fixed-length fingerprint computed from a file by a cryptographic function such as SHA-256. Any change to the file produces a different hash, which makes hashing the basis of evidence integrity. Every item we collect is hashed at capture.
Horizon scanning: Systematic review of emerging developments that could affect an organization months or years ahead, such as political transitions, regulatory change or new criminal methods. Useful only when it ends in specific indicators to watch.

I

Identity integrity: Whether the identity and history a person presents are genuine, consistent across independent records and their own. Distinct from identity verification, which confirms only that a document is authentic and belongs to a real person.
Indicator of compromise: A technical artifact, such as a domain, file hash or network address, associated with malicious activity and used to detect the same activity elsewhere.
Indicators and warnings: Specific, observable developments, defined in advance, that would show a situation moving toward a worse outcome. They turn a forecast into something that can be watched, and later scored.
Influence operation: A coordinated effort to shape opinion or behavior, often by concealing the true source of a message or faking the scale of support for it. See our influence operations service.
Infrastructure pivoting: Moving from one known item, such as a domain, to others that share technical attributes: registration records, certificates, hosting, and analytics or advertising identifiers.
Insider risk: The risk that a person with legitimate access causes harm, whether deliberately, under pressure or by being impersonated. Our work addresses the part that is visible in open sources, and begins only from a specific trigger. See insider risk.
Intelligence requirement: A precisely worded question that collection and analysis must answer. A good requirement states which decision the answer will inform and what a decisive answer would look like.

K

Key judgment: A conclusion stated at the top of a report with its probability term, confidence level and supporting evidence. Key judgments let a reader act without reading the full report, and test it if they do.
Know your customer: The process regulated businesses use to verify the identity of their customers and assess their risk. Open-source research supplements it when the documents check out but something still does not add up.

L

Leak site: A website, often on the dark web, where criminal groups publish stolen data to pressure victims or advertise it for sale. Monitoring leak sites can reveal exposure before a victim is notified. Aldervane never buys stolen data.
Link analysis: Mapping the relationships between people, organizations, accounts, assets and events to reveal structure, intermediaries and points of control.
Link grade: The strength of the evidence for one relationship on a supply chain map. We use three grades: confirmed, probable and possible. A map drawn with uniform lines claims more than its sources support.

M

Managed attribution: Conducting research through infrastructure that cannot be traced to the investigator or the client, so that subjects cannot detect the research. At Aldervane it is used only to observe, never to deceive or engage anyone.
Metadata: Data about data: the timestamps, authorship fields, device details, identifiers and edit histories attached to files, posts and accounts. Frequently more revealing than the content itself.
Misinformation: False or misleading information spread without intent to deceive, often by people who believe it. Compare disinformation.
Money mule: A person who moves illicit funds through their own accounts on behalf of others, knowingly or not. Mule accounts are often the first visible layer of a fraud network's payment rails.

N

Nominee director: A person appointed as a company director to act on someone else's behalf, sometimes for legitimate administrative reasons and sometimes to conceal the real controller. See seeing through nominee directors.

O

Onion service: A website or service reachable only through an anonymity network that hides the location of both the visitor and the host. Many dark web forums and markets operate this way.
Open-source intelligence (OSINT): Intelligence produced from publicly available and lawfully obtained information that has been collected, evaluated and analyzed to answer a specific question. The information is open. The intelligence is the analysis. See our methodology.
Operational security (OPSEC): Practices that stop an adversary from learning about an activity, such as an investigation, from the traces it leaves. Lapses in a subject's operational security are often what make attribution possible.

P

Passive DNS: Historical records of which domains resolved to which network addresses, and when. Used to find domains that shared hosting with a known malicious site, even after they have moved.
Pivot: Using an attribute of one item, such as an email address, image, wallet or identifier, to find other items that share it. Investigations progress through chains of pivots, and fail when a single weak pivot carries too much weight.
Politically exposed person: Someone who holds or has held a prominent public function, along with their close family and associates. The position creates a heightened risk of corruption and conflicts of interest, so their business relationships attract enhanced due diligence.
Pretexting: Obtaining information by lying about who you are or why you want it. Aldervane does not use pretexting under any circumstances.
Priority intelligence requirement: One of the small set of questions that matter most to a decision maker, used to focus collection and monitoring on what is relevant rather than what is merely available.
Protective intelligence: The identification and assessment of threats to specific people, such as executives or public figures, and of the exposure that makes them vulnerable. See our protective intelligence service.
Provenance: The documented origin and history of an item: where it first appeared, who published it and how it reached the analyst. Provenance, established from preserved sources, is the most reliable defense against generated and recycled content.

R

Red-team review: Adversarial review of a finding by an analyst who did not work the case and whose task is to break it. Every Aldervane attribution passes red-team review before it is reported.
Request for information: A specific question submitted by a client, typically within a retained program, and answered with a short finished product on an agreed timeline.
Reverse image search: Searching for other appearances of an image online to find its origin, its earlier uses or the accounts that share it. Essential for exposing recycled profile photos and checking claims about where and when an event happened.

S

Sanctions screening: Checking people and companies against sanctions lists. Screening matches names. It cannot find an owner who is not named, which is why ownership research matters.
Shell company: A company with no significant operations or assets of its own, used to hold assets or move money. Legitimate in many corporate structures and central to most concealment schemes.
Situation report: A short, time-stamped account of a developing event that separates what is verified from what is unverified, false or not yet determined, and states when the next report will follow.
Sock puppet: A fake online identity used to deceive others, for example to praise oneself, attack critics or simulate grassroots support. Distinct from a research persona, which is used only to observe.
Source grading: Rating every source for reliability, from A to F, and every item of information for credibility, from 1 to 6, as two separate judgments. It shows the strength of the evidence behind each conclusion. See how we grade confidence.
Stylometry: Analysis of writing style, such as vocabulary, punctuation, spelling habits and sentence structure, to assess whether texts share an author. Useful supporting evidence, never sufficient on its own.
Sub-tier supplier: A supplier below the first tier: a supplier's supplier, and so on down the chain. Buyers hold contracts with tier one and, increasingly, legal exposure to every tier beneath it. See Past tier one.
Synthetic identity: An identity assembled from real and invented elements, or a persona generated wholly by software. It can look complete on the day it is created. What it lacks is a past that independent records confirm.
Synthetic media: Images, audio or video generated or substantially altered by software, including synthetic profile faces. Detection combines visual artifacts, provenance checks and the surrounding context.

T

Threat actor: A person or group responsible for, or intending, harmful activity, from an individual stalker to an organized criminal enterprise.
Threat assessment: A structured evaluation of whether a person who has made a threat, or is behaving in a concerning way, has the intent and capability to cause harm. It focuses on behavior, not only on words.
Tradecraft: The techniques, disciplines and safeguards of intelligence work. Good tradecraft makes findings reproducible and keeps investigators invisible to the people they study. We teach ours in our OSINT training courses.
Transshipment: Moving goods through an intermediate country or port on the way to their destination. Routine in trade, and also a common way of disguising where goods come from or where they are going.
Typosquatting: Registering domains that closely resemble a legitimate brand, through misspellings or swapped characters, to catch mistyped traffic or to impersonate the brand in phishing and fraud.

U

Username correlation: Checking whether the same or similar usernames on different platforms belong to one person. Common and useful, but distinctive-looking handles are less unique than they appear, so every match needs independent corroboration.

V

Verification: Establishing whether content is what it claims to be: authentic, unaltered, and from the claimed source, time and place.

W

Web archive capture: A preserved copy of a web page that records the server's responses, so the page can be replayed exactly as it was delivered. Stronger evidence than a screenshot. See evidence handling for OSINT.
WHOIS and registration data: Records of who registered a domain and when. Now often hidden by privacy services, but historical records can preserve details from before protection was enabled.

The language of open-source intelligence, defined.

A

B

C

D

E

F

G

H

I

K

L

M

N

O

P

R

S

T

U

V

W

Bring us the question nobody else could answer.