OSINT vs SOCMINT vs HUMINT vs GEOINT: Which Discipline Does Each Holehe OSINT Search Belong To?
OSINT, SOCMINT, HUMINT, GEOINT, FININT and SIGINT are often used as if they meant the same thing. This guide separates them, maps usernames, emails, phone numbers, IPs, domains and wallets to the right discipline, and backs it with live public data.
Ask three analysts what “OSINT” covers and you may get three answers. One means everything found on the open web. Another means technical records such as DNS and WHOIS. A third uses it as shorthand for looking someone up on social media. The confusion is more than pedantry. When a report says a conclusion came from “OSINT”, the reader cannot tell whether it rests on a registry record, a social profile, a satellite image or an interview.
This guide separates the main intelligence disciplines, shows which ones a tool like Holehe OSINT actually touches, and works through each one with live public data pulled on November 4, 2026. It is written for people who run searches and have to explain afterwards what they found and how they know.
Scope note. Holehe OSINT searches four identifier types: username, email, phone number and IP address. It does not do imagery analysis, wallet tracing, interviews or signals collection. Where this article discusses those disciplines, it is to show where the tool stops and where other methods start, not to suggest the site covers them.
Why the Acronyms Cause Real Mistakes
Labels carry assumptions. “HUMINT” implies a person told you something. “OSINT” implies anyone could have found it. “FININT” implies you followed money. If a team mixes them up, the damage shows up in three places:
- Confidence. A claim from an anonymous forum post is not the same as a claim from a company registry, yet both end up filed as “open source”.
- Legality. Reading a public profile and contacting its owner under a false identity are different acts with different legal exposure.
- Handoff. A colleague who reads “SOCMINT” knows to check the account and its context. A colleague who reads “OSINT” knows nothing about where to look next.
The Disciplines in Plain English
| Label | Stands for | Source of the information | Typical output |
|---|---|---|---|
| OSINT | Open-source intelligence | Anything lawfully available to the public: registries, websites, filings, datasets | A sourced finding with a retrieval date |
| SOCMINT | Social media intelligence | Public posts, profiles, handles and connections on social platforms | An account, its history and its apparent owner |
| HUMINT | Human intelligence | People: interviews, tips, sources, direct contact | A statement from a named or protected source |
| GEOINT / IMINT | Geospatial and imagery intelligence | Satellite imagery, maps, photos and video analysed for location and time | A verified place and time for an image |
| FININT | Financial intelligence | Transactions, ownership records, public ledgers | A money trail between two parties |
| SIGINT | Signals intelligence | Intercepted communications and electronic signals | Restricted, usually government-only |
The key point is that OSINT describes how the information is obtained (openly), while the other labels describe what kind of information it is or where it came from. A public social media profile is both OSINT and SOCMINT. A photo posted publicly and then geolocated is both OSINT and GEOINT. The labels overlap on purpose.
Mapping Identifiers to Disciplines and Search Types
The practical question is which label to put on a given piece of evidence. This table pairs each common identifier with the discipline it usually belongs to and the Holehe OSINT tab, if any, that handles it.
| Identifier | Usual discipline | What it answers | Holehe OSINT tab |
|---|---|---|---|
| Username / handle | SOCMINT | Where is this exact handle registered? | Username |
| Email address | OSINT, SOCMINT | Which services recognise this address? | |
| Phone number | OSINT | What type of number is it, and where does it appear? | Phone |
| IP address | OSINT (technical) | Which network operates it? | IP |
| Domain name | OSINT (technical) | Who registered it, when, and where is it hosted? | Not covered |
| Photo or video | GEOINT, IMINT | Where and when was it taken? | Not covered |
| Crypto wallet | FININT | What has moved through this address? | Not covered |
| Named contact | HUMINT | What will this person tell you? | Not covered |
Working Each Discipline With Live Data
The examples below use public sources and identifiers that exist to be looked at: a project’s own repositories, the reserved example.com domain, and the best-known address on the Bitcoin chain. No private individual was searched.
SOCMINT: the tools behind handle research
Handle research is the SOCMINT workhorse, and the tooling around it is a good measure of how much the community relies on it. We pulled star counts from the GitHub API for the best-known open-source projects in this space.
Two readings. First, the two handle tools together hold far more attention than the general-purpose frameworks, which says where day-to-day demand sits. Second, the smallest bar belongs to evidence preservation, the step that decides whether a finding survives scrutiny. Teams routinely spend their effort on finding and not on capturing what they found. The same pattern shows up in our username footprint guide, where we cover the data behind these tools in more detail.
OSINT (technical): domain and DNS records
Registry and DNS records are the cleanest kind of open-source evidence, because they are published by the organisations that hold them. Here is what the public records say about the reserved example.com domain, queried on November 4, 2026.
| Field | Value | Source |
|---|---|---|
| Registered | 1995-08-14 | Verisign RDAP |
| Expires | 2027-08-13 | Verisign RDAP |
| Registry record last changed | 2026-08-14 | Verisign RDAP |
| Name servers | elliott.ns.cloudflare.com, hera.ns.cloudflare.com | DNS lookup (dig NS example.com) |
A domain that has existed for three decades is a different kind of finding from one registered last week. Age, name server provider and change history are all dated facts you can cite. The same logic applies to the IP tab in Holehe OSINT: the network operator and registry fields are published records, while the location estimate is only an estimate. For the full walk-through, see our IP address guide.
FININT: what an open ledger shows, and what it does not
Public blockchains turn financial records into open data. As a demonstration, we queried the address that holds the first block reward of Bitcoin, one of the most-examined addresses on the chain, through the Blockstream public API.
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa, Blockstream API /address endpoint, queried November 4, 2026 with the chain tip at block 974,500. Figures change as new payments arrive. Source: blockstream.info.The ledger tells you exactly how many payments reached this address and that none of them has ever left. What it cannot tell you is who sent them or why. A ledger gives you a precise record of movement and almost nothing about identity, which is why FININT and OSINT are kept as separate labels: the first traces value, the second tries to attach a name to it, and the second step carries far more risk of error.
GEOINT: verifying where and when
Imagery work follows a different logic from account research. You are not asking who posted a picture. You are asking where the camera was standing. The method relies on landmarks, road layouts, shadows and reference imagery, then cross-checking the reference as well, since a map tile can be older than the photo it is being compared to. Bellingcat has published both a long-running beginner’s guide to geolocating videos and a guide to geolocation tools, and the talk below is a practical introduction from one of its trainers.
HUMINT: the one open search cannot replace
Interviews and source contact belong to a different category of work. A person can confirm a detail, correct a mistaken link, or explain why two accounts share a handle. Search tools cannot do any of that. The caution runs the other way too: contacting someone under a false identity to extract information is not open-source research, and it brings legal and ethical duties that passive reading does not. If a lead needs a human answer, hand it to someone authorised to ask.
A Worked Example: Fusing Labels Without Mixing Them
The following is a constructed scenario with reserved .example addresses.
A small business receives an invoice from [email protected]. The finance lead wants to know whether to pay it.
- OSINT (technical): the domain was registered nine days ago and uses a free-tier name server. Evidence grade: confirmed, since both facts come from public registry and DNS records.
- OSINT (email): an email check shows no recognised sign-ups for the address. This is weak on its own, because many services do not reveal registration status.
- SOCMINT: the handle in the invoice footer,
supplier_portal_help, appears on one social platform, created last week. Evidence grade: probable, since the match is by name only. - HUMINT: the finance lead phones the supplier on the number from a previous, verified contract, not the number on the invoice. The supplier confirms they did not send it.
Four disciplines, four different kinds of evidence, each labelled. The decisive step was the phone call, which no search could have replaced. The labels are what let the finance lead explain afterwards why the invoice was not paid.
Good Habits for Reports
- Label provenance for every claim. Say which discipline supplied it, and name the source and date.
- Grade before you fuse. Rate each item (confirmed, probable, handle-only) before combining items into a conclusion.
- Know when to hand off. Imagery verification, ledger tracing and interviews call for specialist skills. Say so and pass them on.
- Preserve evidence. Capture the page, the URL and the time at the moment you see it. Pages change and disappear.
- Stay within your remit. Public availability does not remove data-protection duties. The UK ICO’s guidance on legitimate interests is a useful starting point when personal data is involved; other jurisdictions have their own rules.
Frequently Asked Questions
Is SOCMINT the same as OSINT?
No. SOCMINT is a subset: open-source intelligence drawn specifically from social media. All public SOCMINT is OSINT, but most OSINT is not SOCMINT.
Does Holehe OSINT do HUMINT or SIGINT?
No. It reads public responses from websites and registries for a username, email, phone number or IP address. It does not contact people or collect communications.
Which label should I use for an email check?
Usually OSINT, since it reads public sign-up and recovery responses. If the result points to a social profile you then read, that second step is SOCMINT. Record both.
Can private companies use these disciplines?
Open-source disciplines (OSINT, SOCMINT, open-ledger FININT, open-imagery GEOINT) are widely used by journalists, security teams and compliance staff. SIGINT is restricted to authorised government bodies in most countries, and HUMINT by private parties is bound by consent, deception and data-protection rules.
References
- GitHub REST API: repositories, queried November 4, 2026 for the star counts in the chart
- Blockstream Esplora API documentation and blockstream.info, address query November 4, 2026
- Verisign RDAP record for example.com, queried November 4, 2026
- RFC 9083: JSON responses for RDAP
- Bellingcat: A Beginner’s Guide to Geolocating Videos
- Bellingcat: Searching the Earth, Essential Geolocation Tools for Verification
- Intro to OSINT and Geolocation, MCH2022 (media.ccc.de)
- What Is Holehe OSINT? and Top OSINT Techniques for Digital Footprint Investigation on this site
