Which item is not typically considered an OSINT data source?

• A. Public registries
• B. Social media
• C. Internal corporate emails
• D. Public breach repositories

Answer: (C)

OSINT relies on information that is publicly available and accessible without special authorization. Internal corporate emails do not fit because they are private, controlled by the organization, and access requires authentication. They contain sensitive, confidential material and using them would invade privacy and violate laws and policies. The other items are typical OSINT sources: public registries provide official records that anyone can access; social media posts are publicly visible and commonly used for context; public breach repositories host data that has been exposed in breaches and is often publicly available, useful for assessing compromised accounts. Therefore, internal corporate emails are not typically considered an OSINT data source.