Quick answer
Use infrastructure OSINT to build leads, not to declare attribution.
Domain and DNS investigation turns one public clue into adjacent evidence: certificates, redirects, DNS records, hosting, archived pages, public scans, and reputation context. The mistake is treating overlap as ownership. Shared hosting, CDNs, resellers, parked domains, and reused infrastructure can all create false links.
- Start with: exact domain, current DNS, archives, redirects, and certificate history.
- Add context with: urlscan.io, SecurityTrails, ViewDNS.info, DNSDumpster, crt.sh, Shodan, Censys, Netlas.io.
- Escalate carefully: suspicious domains can be checked through VirusTotal, URLhaus, PhishTank, Cisco Talos, or AlienVault OTX.
- Never overclaim: infrastructure overlap is a lead unless another evidence layer supports it.
Recommended investigation stack
Certificate leads
crt.sh
Useful for certificate transparency searches, subdomain discovery, historical certificate names, and clues that connect domains by certificate timing or naming.
Best for: first-pass subdomains and certificate history
Page-load evidence
urlscan.io
Shows redirects, requests, screenshots, scripts, response headers, and page-load behavior from public scans. Choose visibility carefully before submitting sensitive URLs.
Best for: redirects, scripts, visual evidence, scan snapshots
DNS and history
SecurityTrails, ViewDNS.info, DNSDumpster
Useful for current and historical DNS, related records, mail records, and adjacent host clues. Coverage varies by provider and time period.
Best for: DNS history, host pivots, infrastructure mapping
Exposed services
Shodan, Censys, Netlas.io
Useful for internet-facing hosts, ports, certificates, banners, and service metadata. Keep this passive and do not turn research into unauthorized testing.
Best for: passive host context and public exposure snapshots
Investigation order
- Normalize the domain and capture the original page, email, or source where it appeared.
- Check current DNS, MX, nameservers, redirects, and archive history.
- Search certificate transparency for related names and historical certificate clues.
- Use public scan tools to document page behavior, scripts, redirects, and visible infrastructure.
- Compare findings across at least two independent sources before drawing a relationship.
Safety boundary
This guide is for passive public-source research. Do not probe, exploit, bypass access controls, or interact with suspicious infrastructure beyond normal safe browsing and documented public lookup tools.
Where to go next
Use the domain and infrastructure collection, Investigate a Domain or Website, or Shodan vs Censys vs SecurityTrails.
