An OSINT aggregator is a service or tool that gathers open-source intelligence from public places such as leak sites, forums, social media, breach trackers, and news feeds. It does not necessarily verify whether every item is true, current, or complete; its job is to collect and surface signals quickly.
In cyber security, aggregators matter because they help defenders spot emerging threats, monitor brand abuse, and detect possible data leaks earlier. They also matter to attackers, who use public leak-site claims to apply pressure, even when the underlying breach is not yet confirmed. Because these feeds can include rumors, duplicates, or exaggerated counts, analysts should treat them as leads, not proof. Good defense means cross-checking the claim against internal logs, exposed data samples, and incident-response findings before taking action.