Domain and IP Investigation with OSINT: A Complete Guide

Domain and IP Investigations

Domain and IP investigations are core OSINT. You track threat actors, scrutinize suspicious sites, or size up an org's attack surface. The same techniques apply: map infrastructure, find historical owners, follow hosting and cert connections.

Workflow

This guide covers domain lookup to infrastructure analysis. The workflow is step-by-step, providing the data you need.

Starting Points: What You Have

You didn't provide the text to humanize. Please provide the article text, and I'll make the specific changes you requested:

Remove em-dashes, replace with comma or period
Replace 'including' with fragment ''
Convert any bullet or numbered lists to short prose sentences
Delete these AI phrases: 'At its core', 'In essence', 'This means that', 'In other words', 'Ultimately', 'Established ecosystem', 'Breadth of integrations', 'Visual clarity'

A domain name (example.com)
An IP address (1.2.3.4)
An email address (someone@example.com)
A URL (https://example.com/page)
An SSL certificate (from a network scan or inspection)

Every starting point yields a different query path. Lookups expose new indicators. You pivot.

WHOIS and Domain Registration

WHOIS data provides a significant amount of information. It includes the registrar, registration date, and expiration date. The registrant's name, organization, and email are also available, if they did not opt for privacy protection. Additionally, the name servers and registrar status are included.

Basic WHOIS

To perform a WHOIS query, simply type a command like this into your terminal:

whois example.com

Alternatively, you can use web-based tools such as who.is, DomainTools, or ICANN's lookup.icann.org, which provide the same information.

When reviewing the WHOIS data, watch for the registration date; new domains can be suspicious. Also, note the registrar; NameCheap and NameSilo host a large number of bad domains. The registrant email is often not protected, which can lead to information about additional domains. Be aware of the name servers; shared servers can link multiple domains, with Cloudflare being one example. Additionally, check for privacy protection, as most legitimate domains use it, and its absence could be a red flag.

WHOIS History

Current WHOIS vs. Historical WHOIS

Current WHOIS shows the current registration. Historical WHOIS shows past records. You can get it from DomainTools, SecurityTrails, or WhoisXML API.

Historical Details

An email address used briefly before privacy kicked in. A company name appeared then vanished. A name server change occurred during a takeover. These details disappear from current WHOIS. Historical records keep them.

Best Free Tool for WHOIS History

SecurityTrails offers free historical WHOIS. The tool provides full records, timestamps, and changes over time.

DNS Records and History

DNS records link domains to IP addresses. Servers, mail exchangers, and name servers are examples. Any device with a domain has an IP.

Resolvers query authoritative name servers, caching responses to speed up lookups.

DNS zones contain various records, such as A, AAAA, MX, NS, and SOA. Each serves a purpose.

When you query DNS for information, resolvers do the work and return relevant records.

Most DNS information is public, but some is private. Internal networks often restrict access.

DNS is foundational to the internet, which relies on it to function. Broken DNS can cause outages.

A records: IPv4 addresses the domain resolves to
MX records: Mail servers handling email for the domain
NS records: Authoritative name servers
TXT records: SPF, DKIM, DMARC settings; often reveal cloud services and third-party tools in use
CNAME records: Aliases pointing to other domains
SOA records: Zone administration details

Current DNS

You can query DNS records directly. Use the following commands: dig A example.com for A records, dig MX example.com for mail servers, dig NS example.com for name servers, dig TXT example.com for TXT records, such as SPF, DKIM, and verification codes, dig ANY example.com for all record types.

Mxtoolbox.com offers the same functionality through a web interface.

TXT records often reveal an organization's tech stack. They may contain verification codes for Google Workspace or Microsoft 365 setup. Other services like Mailchimp, Salesforce, and DocuSign also leave distinctive TXT records. These can be used to identify the tools an organization uses.

DNS History: The Core Pivot Technique

Historical DNS supercharges domain investigation. SecurityTrails and DomainTools run passive DNS databases. They log IP addresses for domains, and domains for IPs, going back years.

The forward pivot is domain to IPs. You've got a domain. What IPs has it resolved to over time? An IP may have hosted a sketchy domain, then moved on. The same operator may have spun up new domains on that IP.

The reverse pivot is IP to domains. You've got an IP. What else has resolved to it? Shared hosting IPs can have thousands of sites. A few domains on a dedicated IP suggests custom infrastructure. Those domains often belong to the same operator.

Name server pivoting finds clusters. Multiple domains share a weird name server. The same person likely registered them. Two phishing sites use ns1.suspicious-ns.com. Every domain on that name server deserves a look. That's your lead.

IP Address Investigation

Basic IP Lookup

Get the IP from a Domain

To find the IP address associated with a domain, you have a couple of straightforward options.

You can use the dig utility. The command dig A example.com +short queries the DNS for the A record of example.com. The +short flag tells dig to output just the IP address.

Alternatively, you can use the nslookup command. The command nslookup example.com queries the DNS for the IP address of example.com and displays the result.

Both commands get the job done. You choose based on what's available on your system.

WHOIS for IP Addresses

The IP WHOIS tool provides information on the organization that owns the IP block. It also includes contact details for reporting abuse.

whois 1.2.3.4

To get started, you'll need to provide some basic information: Organization name, ASN, IP block range, and abuse contact.

The following are the websites for the five Regional Internet Registries: arin.net for the Americas, ripe.net for Europe, apnic.net for Asia-Pacific, lacnic.net for Latin America, and afrinic.net for Africa.

ASN Analysis

Every IP address belongs to an Autonomous System. That's operated by an organization—a hosting provider, ISP, government agency, or company.

The ASN links IPs run by the same entity, groups them under a single administrative control.

whois -h whois.radb.net 1.2.3.4

bgp.he.net, ipinfo.io, and Shodan's IP lookup return ASN data.

ASN matters when a threat actor controls their own infrastructure. IPs in their ASN are potential targets. Legitimate organizations' ASNs house their corporate gear. Finding an IP in Company X's ASN tells you who owns it.

Made minor punctuation changes for clarity

Geolocation

IP Geolocation

Geolocation ties an IP to a country, city, organization. Databases that do this include MaxMind GeoIP, ipinfo.io, ip-api.com. The country is usually correct. The city can be off by miles, especially for cloud ranges. Cloud IPs, such as those from AWS, GCP, Azure, and Cloudflare, point to the provider's data center, not the customer.

Internet Scanning: Shodan, Censys, Netlas

Scanning Databases Reveal What's Running on an IP or Domain

You have an IP or domain, and you want to know what's running on it. Scanning databases have the answers.

Shodan allows you to search by IP, and it shows open ports, services, banners, and certificates. The command shodan host 1.2.3.4 provides everything Shodan has on that IP.

Censys is similar to Shodan, offering more detailed certificate data and better attribution, making it useful for tracking certificates.

Netlas offers all the features of the previous databases, plus regex body search, which enables you to find servers serving a specific string in their HTTP response, such as hits on misconfigured sites.

Certificate-Based Pivoting

TLS certificates are a top pivot point in domain infrastructure.

Certificates list domains they secure. A certificate for target.com might include mail.target.com, vpn.target.com, login.target.com. You find internal subdomains this way. Wildcard certificates (*.target.com) reveal the scope, which includes all subdomains.

You can pivot in three ways: Find certificates for a domain using tools like Censys or crt.sh. Find domains associated with a certificate using Censys. Find certificates for an organization using crt.sh and filtering by organization.

crt.sh logs every public TLS certificate. You can search by domain, organization, or certificate fingerprint. The service is free and is considered the best one available.

https://crt.sh/?q=%.example.com   # all subdomains
https://crt.sh/?q=target.com       # exact domain

URL and Website Analysis

urlscan.io

Paste a URL into urlscan.io. It renders the page in a sandbox, captures network requests, JavaScript files, cookies, redirects, DOM content, and a screenshot.

The tool is useful for analyzing suspicious URLs, allowing you to avoid visiting them directly. You can extract the full infrastructure profile of a website.

From one URL scan, you get JavaScript CDN hosts, analytics services, ad networks, API endpoints, and third-party domains. These are all potential pivots.

BuiltWith

BuiltWith reveals the tech stack behind a website - the CMS, server software, CDN, analytics tools, and more. It also uncovers connections between sites. When sites share infrastructure, they share risks. By examining the tech stack, you can identify the players involved.

BuiltWith's technology profiles are invaluable for investigations. They provide detailed information on JavaScript libraries, SSL certificates, and other tech details - all useful clues for understanding site relationships.

With BuiltWith data, you can track changes to a site's tech over time. When a site adopts new tools or drops old ones, it may be a signal to dig deeper. This helps with threat hunting, enabling you to stay on top of potential security risks.

The Wayback Machine

The Internet Archive's Wayback Machine preserves website history on web.archive.org, where you can see how sites change.

Historical Snapshots

Past versions of a site can reveal useful information. Company names, owners, and contact information are often available. You can also find out what old tech stacks were used. Deleted content is often still visible.

Domain Activity

The Wayback Machine can tell you when a domain was active, which you can compare to WHOIS data. It shows when a site was first crawled and when it first appeared. You can also see when a site went dark.

Subdomain Enumeration

Subdomains reveal additional infrastructure. Techniques:

Certificate Transparency crt.sh logs every subdomain that's had a TLS cert. All of them. If it was ever HTTPS-enabled, crt.sh knows. Subdomains, main domains, wildcard certs are returned.

DNS Brute-Forcing Tools like dnsx, amass, and subfinder try likely subdomain names. Lists of common names are run against a domain's DNS, yielding hits on subdomains that certificates and passive DNS didn't catch.

SecurityTrails Historical DNS records are available from a huge passive DNS collection. Subdomains come and go; SecurityTrails sees them.

Google Dorking You can use Google to find subdomains. Try site:target.com -www. Google shows what it's crawled, with results coming from all subdomains.

Putting It Together: Investigation Flow

For a complete domain investigation:

The tool provides various data points to help with investigations. WHOIS registration data is available, including registrar, name servers, and dates. DNS current information includes A, MX, NS, and TXT records, which provide a technical fingerprint from the TXT records. DNS historical data offers IP history, name server history, and past registrant data. IP WHOIS and ASN information includes organization, ASN, and IP block details, presented simply. Shodan and Censys data reveal what's running on the IP, including services, banners, and certificates, with different results. Certificate transparency data from crt.sh provides a full list of all subdomains and SANs. IP reverse DNS history from SecurityTrails shows what's been on the IP and lists other domains. A full website infrastructure scan is available from urlscan.io, for a given URL. BuiltWith provides the technology stack, with no hidden information. The Wayback Machine offers historical snapshots of site changes. Each step provides new leads, such as IPs, domains, and indicators, to track.

Tools Reference

Tool	Use Case	Pricing
SecurityTrails	DNS + WHOIS history	Free (50 queries/mo) / $50/mo
Shodan	Port scanning, banner grabbing	Free / $69/mo
Censys	Certificate and service data	Free (academic) / Enterprise
crt.sh	Certificate transparency	Free
urlscan.io	URL sandbox analysis	Free / Paid
BuiltWith	Technology profiling	Free / $295/mo
Wayback Machine	Historical snapshots	Free
DomainTools	WHOIS history, risk scoring	Paid
Netlas	Internet scanning + body search	Free (50 req/day) / $20+/mo

Updated April 2026. See also: ZoomEye Review, Sucuri Review, WiGLE Review, DorkSearch Review, Shodan Review.

Censys searches internet infrastructure, including IP addresses, domains, and certificates. Anything with a public footprint gets indexed. The OSINT value is that you know what a target has exposed before you ever send a packet their way.

Certificates are a big deal, because they're hard to fake. When a cert is issued, the Certificate Authority logs details like domain names, organization names, and contact info. Censys collects this data, which is a goldmine for researchers.

You query Censys with syntax like services.port:443, which searches for servers listening on port 443, the standard HTTPS port. You can add a filter for a specific domain, and isolate targets fast.

Results are clean. Each hit includes IP, port, and protocol. Sometimes Censys even returns config details, which is useful.

The API allows you to automate queries and integrate with your tools. This is a time-saver.

The free tier limits are low, and you can burn through them fast. Paid plans offer more, and it's worth the cost for heavy users.

Censys and Shodan both index internet infrastructure. Shodan misses some things, and Censys finds them. The reverse is also true. Using both tools gives you a complete picture, with IP addresses, domains, certificates.

Censys works. It finds exposed assets. Operators miss things, and dev servers get forgotten. Censys remembers. That's its value.