OSINT Cheat Sheet 2026

The 30 highest-yield OSINT facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In the context of OSINT, what does 'data enrichment' mean? → Adding contextual information to raw data to increase its analytical value
2. How should a OSINT professional handle a situation where automation & scripting fundamentals protocols conflict with practical constraints? → Document the conflict and seek guidance from appropriate authorities
3. What is the primary advantage of using SpiderFoot's automated workflows over manual OSINT collection? → It chains multiple data sources automatically to build a complete target profile
4. What is 'reverse image geolocation' as practiced in OSINT investigations? → Analyzing visual cues within an image to determine where it was photographed
5. What is the OSINT implication of a social media account that suddenly changes its username, profile picture, and biography simultaneously? → The account may be repurposing an established following for a new deceptive campaign
6. What is 'sockpuppet detection' in people-search OSINT? → Identifying fake online accounts created by the same real individual
7. What is the significance of a social media account's 'follower-to-following ratio' in OSINT analysis? → An unusually high ratio may indicate bot activity or purchased followers
8. Which tool is commonly used for link and network analysis in OSINT reporting? → Maltego
9. When investigating dark web actors, what does cross-referencing a PGP key fingerprint across multiple platforms potentially reveal? → Linked identities across dark web forums, encrypted email, and clearnet profiles
10. When analyzing a Facebook group for OSINT, which feature provides the most historical data about group activity and membership changes? → Member list sorted by join date
11. Which of the following best describes a key competency required for automation & scripting fundamentals in OSINT certification? → Critical thinking and evidence-based decision making
12. When a conflict arises between standard procedures and a unique situation in Deep & Dark Web Investigation, what should a OSINT professional prioritize? → Safety and ethical obligations while seeking expert consultation
13. Which principle of OSINT methodology requires that collected information be evaluated against multiple independent sources before being treated as reliable? → Corroboration
14. When a conflict arises between standard procedures and a unique situation in Social Media Intelligence, what should a OSINT professional prioritize? → Safety and ethical obligations while seeking expert consultation
15. In Open Source Intelligence Certification, what role does incident response & disaster recovery play in ensuring client/stakeholder satisfaction? → It builds trust through demonstrated competence and consistency
16. When building a long-term cover identity for OSINT collection, which element is most critical for withstanding deep adversary scrutiny? → Consistent, verifiable digital history across multiple platforms over time
17. Which metadata field in a photograph is MOST commonly used for geolocation purposes in OSINT investigations? → GPS coordinates in EXIF data
18. When collecting data from social media platforms via API, what is the most common throttling mechanism an analyst must manage? → Rate limits that cap the number of API requests per time window
19. Which landmark feature is MOST useful when geolocating an image using building architecture? → Distinctive architectural styles, signage, or unique structural elements
20. An investigator finds a person's profile picture and wants to find other accounts using the same image. Which method is most appropriate? → Reverse image search
21. Which service aggregates data from internet-wide port scans and allows analysts to query historical port/service data for a specific IP address? → Censys
22. Which documentation practice is most important for cloud infrastructure & deployment in the OSINT field? → Maintaining complete, accurate, and timely records
23. What is the significance of 'pattern of life' analysis in OSINT investigations? → It establishes a subject's routine behaviors and activities to detect anomalies
24. An OSINT analyst discovers that several unrelated domains share the same Google Analytics tracking ID (UA-XXXXXX). What does this most likely indicate? → The sites are likely operated by the same person or organization
25. Which free tool is widely used by investigators for initial Bitcoin address lookups and transaction history? → Blockchain.com Explorer
26. An analyst identifies a username used across multiple platforms. Which tool category is MOST useful for automating cross-platform username searches? → Username enumeration tools (e.g., Sherlock, Maigret)
27. What is 'cognitive bias' and why is it a significant concern in OSINT analysis? → A mental shortcut that can distort an analyst's judgment and conclusions
28. What is the primary function of the tool Maltego? → OSINT data visualization and relationship mapping
29. Which OSINT database is best suited for researching global company ownership and incorporation details? → OpenCorporates
30. Which search operator can be used on Google to find results from a specific website? → site: