T1593

Official Description

Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)

Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)).

Tactics: Reconnaissance
Platforms: PRE
MITRE Version: 1.1
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Sub-techniques (3)

T1593.001 · Social MediaT1593.002 · Search EnginesT1593.003 · Code Repositories

Reported Context (1)

The article maps use of regional trust-themed web templates and multiple domains to searching open websites or domains. Researchers Map Multilingual ZIP Phishing Campaigns Targeting Asian Organizations

Malware (3)

MITRE ATT&CK (9)

Vendors (1)

Tools (2)

Industries (3)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.