Use Case Guide

Scenario-led workflow

Investigate a Domain or Website

Editorial

A repeatable workflow for turning a domain, URL, or suspicious website into corroborated ownership and infrastructure context.

Problem

You have a domain or website in front of you and need to turn it into a defensible picture of ownership, infrastructure, and risk without jumping to attribution too quickly.

Suggested workflow

Capture page state -> check DNS and certificate history -> map infrastructure pivots -> corroborate ownership claims -> report with caveats.

Best for

Journalists, investigators, and analysts starting from a site, landing page, or suspicious domain.

Verification boundaries

Use archived captures, DNS history, and infrastructure pivots together. Any single one of those signals can mislead on its own.

Workflow notes by depth

Beginner: Do not start with attribution. Save the page first, record the domain, and compare two simple sources before making the workflow more technical.

Intermediate: Treat DNS history, certificate reuse, and exposed hosts as clues that need corroboration, not as standalone proof of control.

Advanced: Cluster related infrastructure only after you have enough historical overlap to rule out commodity hosting noise and generic shared services.

Practical cautions

Stay on the passive side of the line. Do not authenticate, bypass controls, or test live infrastructure beyond publicly exposed information that the tools already surface.

Editorial position: Use this page to sequence the work, then move into the linked tools and comparisons for product-level tradeoffs.

Useful tool lanes: Archives & Historical Web, Domain & DNS Intelligence, Network & Attack Surface

Suggested Tool Stack

Start with tools that fit this job.

Preserve the live page before pivoting. Then establish registration and infrastructure history; a shared host, certificate, or nameserver is a lead, not proof of common ownership.

Browse all tools

Step 1

urlscan.io

Role: Preserve live page behavior

Start by recording the rendered page, redirects, and loaded resources before a suspicious or important website changes.

Editorial
Open profile
Wayback Machine official-page screenshot

Official-page screenshot

Internet Archive

Verified 2026-05-27

Historical web captures for deleted or changed pages

Verification: Editorial review Workflow: Archiving Pricing: Free

Best for: Historical web-page review, Save Page Now capture, deleted-page recovery, source preservation, claim timelines, profile changes, and before/after web…

Editorial

Step 2

Wayback Machine

Role: Compare historical claims

Archived pages reveal earlier ownership language, contact details, products, and claims that can corroborate or challenge the live site.

Editorial
Open profile
WHOIS Lookup Workflow official-page screenshot

Official-page screenshot

ICANN Lookup / RDAP workflow

Verified 2026-05-27

RDAP/WHOIS registration-data checklist for domain leads

Verification: Editorial review Workflow: Verification Pricing: Free

Best for: Current RDAP registration-data checks around a scoped domain, IP network, or ASN, including registrar, registration-date, nameserver, status, and…

Editorial

Step 3

WHOIS Lookup Workflow

Role: Confirm registration context

Use current RDAP details, dates, registrar, and nameservers to tie later pivots to the correct domain and time window.

Editorial
Open profile
crt.sh official-page screenshot

Official-page screenshot

Sectigo

Verified 2026-05-27

Free certificate-transparency lookup for domain pivots

Verification: Editorial review Workflow: Discovery Pricing: Free

Best for: Certificate-transparency pivots around domains, organizations, hostnames, SAN entries, fingerprints, and historical infrastructure naming patterns.

Editorial

Step 4

crt.sh

Role: Expand certificate-linked names

Certificate Transparency records can expose subdomains and historical naming clues that do not appear on the current website.

Editorial
Open profile

Step 5

SecurityTrails

Role: Reconstruct DNS history

Use dated DNS, IP, and nameserver changes to distinguish meaningful infrastructure history from the domain's present configuration.

Editorial
Open profile

Start by capturing the exact URL, the visible claim, and the time you accessed it before you pivot anywhere else. Domain investigations become harder to defend when the first snapshot is missing.

Recommended sequence

  1. Preserve the visible page with urlscan.io, Wayback Machine, or Archive.today if the content may change.
  2. Check domain history, DNS records, and certificate clues with SecurityTrails, crt.sh, and WHOIS-style lookups.
  3. Expand the infrastructure view with Shodan or Censys when the case depends on hosts, ports, certificates, or related services.
  4. Only move into reporting after you have at least two independent signals that support the same ownership or attribution story.

Where this breaks down

Registrar data can be stale, privacy protection can hide ownership, and reused infrastructure can create false links. A shared host or reused certificate is not proof of a shared operator.

Before you publish

Keep screenshots, timestamps, and the exact pivot trail. If the conclusion depends on inference rather than direct evidence, label it as such.

Read alongside

Collections

Reviews

Compare next

Best for: Investigators, Journalists, OSINT Practitioners

Methodology note

This guide is built for corroboration first. It favors preservation, passive discovery, and evidence you can explain later.