Quick answer
Use infrastructure OSINT to build leads, not to declare attribution.
Domain and DNS investigation is powerful because it turns one public clue into adjacent evidence: certificates, redirects, DNS records, hosting, archived pages, public scans, and reputation context. The mistake is treating overlap as ownership. Shared hosting, CDNs, resellers, parked domains, and reused infrastructure can all create false links.
- Start with: exact domain, current DNS, archives, redirects, and certificate history.
- Add context with: urlscan.io, SecurityTrails, ViewDNS.info, DNSDumpster, crt.sh, Shodan, Censys, Netlas.io.
- Escalate carefully: suspicious domains can be checked through VirusTotal, URLhaus, PhishTank, Cisco Talos, or AlienVault OTX.
- Never overclaim: infrastructure overlap is a lead unless another evidence layer supports it.
Recommended investigation stack
Certificate leads
crt.sh
Useful for certificate transparency searches, subdomain discovery, historical certificate names, and clues that connect domains by certificate timing or naming.
Best for: first-pass subdomains and certificate history
Page-load evidence
urlscan.io
Shows redirects, requests, screenshots, scripts, response headers, and page-load behavior from public scans. Strong for documenting what a site did at a moment in time.
Best for: redirects, scripts, visual evidence, scan snapshots
DNS and history
SecurityTrails, ViewDNS.info, DNSDumpster
Useful for current and historical DNS, related records, mail records, and adjacent host clues. Coverage varies by provider and time period.
Best for: DNS history, host pivots, infrastructure mapping
Exposed services
Shodan, Censys, Netlas.io
Useful for internet-facing hosts, ports, certificates, banners, and service metadata. Keep this passive and do not turn research into unauthorized testing.
Best for: passive host context and public exposure snapshots
Investigation order
- Normalize the domain and capture the original page, email, or source where it appeared.
- Check current DNS, MX, nameservers, redirects, and archive history.
- Search certificate transparency for related names and historical certificate clues.
- Use public scan tools to document page behavior, scripts, redirects, and visible infrastructure.
- Compare findings across at least two independent sources before drawing a relationship.
What each clue can and cannot prove
DNS records
Can show operational configuration. They do not prove who controls the broader campaign or organization behind a site.
Certificates
Can reveal related hostnames and timing. They can also reflect automation, temporary tests, shared services, or abandoned infrastructure.
WHOIS and registration
Can identify registry data when available. Privacy proxies, resellers, stale records, and jurisdiction differences limit certainty.
Threat-intel labels
Can support triage. They should not become final proof of intent without source context and corroboration.
Safety boundary
This guide is for passive public-source research. Do not probe, exploit, bypass access controls, or interact with suspicious infrastructure beyond normal safe browsing and documented public lookup tools.
Where to go next
Use Tools for Domain, DNS, and Web Infrastructure Research for the curated stack, or follow Investigate a Domain or Website for workflow order.