I treat recon as the work of building context, not collecting random data. I combine information from many sources, check how trustworthy it is and look for the connections that make an organisation, its infrastructure and its real exposure understandable before any technical analysis begins.
OSINT, Reconnaissance, Passive Recon, Active Recon, Attack Surface Mapping, Asset Discovery, Subdomain Enumeration, DNS, Certificate Transparency, WHOIS, Search Engines, Shodan, Censys, Maltego, Metadata Analysis, Social OSINT, Threat Intelligence