Tools for Domain, DNS, and Web Infrastructure Research

Start with a defined domain, host, or website and a question. This collection covers DNS history, certificate observations, indexed services, page captures, and visible web technology. Use these layers to corroborate a lead, not to jump from a shared address to an ownership allegation.

Follow the evidence layer

1. Domain and DNS context: use SecurityTrails, DNSDumpster, MXToolbox, WhoisXML API, ViewDNS.info, or DNSlytics for the relevant record type. Check whether the result is current, historical, inferred, or unavailable.
2. Certificates: crt.sh provides logged certificate leads. A certificate entry is not proof that a hostname is currently reachable or controlled by a particular person.
3. Indexed services: Shodan and Censys provide observed infrastructure context. Compare observation times and scope, not just the number of matches.
4. Page and technology context: urlscan.io, Wappalyzer, and BuiltWith can help investigate page behavior or technology clues. Review submission visibility before sending a URL to a third-party service.
5. Corroboration: DomainTools, Netlas.io, ZoomEye, FOFA, ONYPHE, or VirusTotal may address a remaining history, exposure, or reputation question. Confirm current access and coverage; a second dataset does not automatically make an inference correct.

For a quick current-record check, digga brings DNS resolver answers and domain registration data into one browser workflow. Our 3 October 2026 check corroborated DNS and RDAP only; use a historical service for change-over-time questions.

Specialist additions and their boundaries

• Validin supplies DNS and infrastructure context for relationship investigation. Shared infrastructure is a lead, not established common control.
• Subfinder collects passive subdomain leads from configured sources. Source credentials, limits, and coverage affect the result.
• OWASP Amass supports attack-surface mapping and asset discovery. Review the selected mode and configuration: do not assume every operation is passive or authorized.
• dnstwist generates domain variants for impersonation research. A lookalike spelling is not proof of malicious intent. Some options perform network requests; define scope before running them.
• SpiderFoot can collect across multiple sources. Inspect enabled modules, target scope, and source terms before automating.

RiskIQ PassiveTotal and BinaryEdge remain in the collection as legacy/context entries, not current standalone lookup recommendations. Coalition’s BinaryEdge transition FAQ gives March 31, 2025 as the standalone service’s closure date. Do not plan a new workflow around historical product instructions without confirming the current service and access route.

Preserve a defensible observation

Record the source, query, time, returned record, and alternative explanations. CDNs, shared hosting, wildcard certificates, expired records, and reassigned addresses all complicate attribution. Reading indexed data and actively scanning a target are different activities; obtain authorization for probing and respect service limits.

Selection and sources

Reviewed September 26, 2026. Selection is based on complementary evidence layers and documented capabilities, not sponsorship or an accuracy benchmark. Specialist sources: Validin, Subfinder documentation, OWASP Amass, and dnstwist.

Use Shodan vs Censys vs SecurityTrails to choose the next pivot, the domain investigation workflow to structure the work, and the preservation stack to retain the source evidence.