Domain

Use this page for passive domain investigation: registration data, RDAP/WHOIS, DNS records, passive DNS, certificate transparency, archives, email security records, typosquatting, redirects, and related infrastructure pivots. Active subdomain brute forcing, takeover testing, nuclei scanning, and exploit-driven recon belong in Red Offensive.

WHOIS vs. RDAP

WHOIS is the older registration lookup protocol. It is useful, but responses are inconsistent across registrars and hard to parse reliably.

RDAP (Registration Data Access Protocol) is the modern successor. The core RFC 7480 series was published in 2015, and ICANN's gTLD RDAP requirements have continued to expand since then. RDAP provides structured JSON responses, better internationalization support, authentication-aware access, RESTful APIs, and more consistent privacy handling.

• RDAP Lookup

• ICANN RDAP

Domain.html

Domain.html is a multi-lookup helper for pivoting through domain investigation sources.

• Registration Data - WHOIS/RDAP-style ownership and registrar details.

• Hosting Data - Hosting provider and related infrastructure.

• Archive Data - Wayback Machine, Archive.today, and other historical snapshots.

• Analytics Data - Similar sites, backlinks, and relationship pivots.

• Threat Data - Use the Threat Data page for reputation and enrichment.

• Shortened URL Metadata - Shortener preview and redirect investigation.

Local helper copy: Domain.html

Domain Toolboxes

• ViewDNS - DNS, reverse IP, IP history, and related lookup utilities.

• DNSDumpster - Passive DNS reconnaissance and visualization.

• MXToolbox - MX, DNS, DMARC, and blacklist diagnostics.

• DNSLytics - Domain/IP/provider relationships and historical data.

• HostSpider - Domain information gathering CLI.

Passive DNS and Historical Records

Passive DNS systems collect observed DNS resolution history. Use them to find past hosting, related subdomains, and infrastructure relationships without directly touching a target.

• SecurityTrails - Passive DNS, WHOIS history, and subdomains.

• Farsight DNSDB - Passive DNS database.

• Microsoft Defender Threat Intelligence - Formerly RiskIQ/PassiveTotal; passive DNS, WHOIS, certificates, trackers, and threat intelligence.

• Passive DNS Mnemonic - Historical DNS data.

• Cisco Umbrella Investigate - DNS security and passive DNS context.

• AlienVault OTX - Indicator relationships and passive DNS pivots.

More indicator-focused passive DNS sources are maintained on Threat Data.

Threat Data

Reverse WHOIS and Reverse IP

• ViewDNS Reverse IP - Domains hosted on the same IP.

• WhoisXMLAPI Reverse WHOIS - Search domains by registrant name, email, or organization.

• DomainTools Reverse WHOIS - Commercial reverse WHOIS.

• Hosting Checker - Hosting provider and shared-hosting lookup.

• YouGetSignal Reverse IP - Domains sharing an IP.

• Bing IP Search - Use ip:x.x.x.x to find indexed domains on an IP.

Passive Subdomain Discovery

These tools primarily use public datasets, certificate transparency, search engines, or other passive sources. They are useful for OSINT and scoping, but review each tool's options because some can also perform active queries.

• Chaos - ProjectDiscovery subdomain dataset.

• Pentest-Tools Subdomain Finder - Online subdomain discovery.

• censys-subdomain-finder - Enumerates subdomains from Censys certificate data.

• ctfr - Certificate Transparency subdomain discovery.

• Sublist3r - OSINT subdomain enumeration. Some older sources it references, such as ThreatCrowd, are no longer active.

• Subfinder - Fast passive subdomain discovery by ProjectDiscovery.

• Assetfinder - Finds domains and subdomains related to a target.

Active DNS reconnaissance and brute forcing tools such as Amass active modes, puredns, dnsenum, fierce, dnsrecon, MassDNS, and dnsx are preserved in Red Offensive.

Reconnaissance and Scanning

Domain Reputation and Threat Intelligence

Domain reputation lookups are maintained on Threat Data to avoid repeating the same VirusTotal, URLhaus, PhishTank, Talos, OTX, Pulsedive, and Google Safe Browsing resources across multiple pages.

Threat Data

Email Security Records

Email authentication records help verify legitimate sending infrastructure and can expose authorized third-party services.

• MXToolbox DMARC Lookup

• MXToolbox SPF Lookup

• DKIM Validator

• DMARCian Inspector

• EasyDMARC Tools

• Mail-Tester

Typosquatting and Domain Permutations

• dnstwist - Domain permutation engine for typosquatting and phishing detection.

• URLCrazy - Domain typo and variation generator.

Favicon Hash and Technology Fingerprinting

• Shodan Favicon Hash Search - Use http.favicon.hash: to find related servers.

• FavFreak - Fetch favicon hashes for Shodan searches.

• Wappalyzer - Website technology profiler.

• BuiltWith - Website technology and hosting profile.

• WhatRuns - Browser extension for web technology detection.

• Netcraft Site Report - Site technology and hosting report.

Certificate Transparency

• crt.sh - Certificate Transparency search.

• Entrust CTSearch

• CertSpotter - Certificate monitoring.

• SynapsInt - Unified OSINT research tool.

• Censys Certificates

• Google Certificate Transparency Report

• SSLMate CT Policy Analyzer

Archive and Historical Data

• Wayback Machine - Historical website snapshots.

• Archive.today - On-demand and historical page archives.

• CachedView - Google cache, Wayback Machine, and Archive.today helper.

• waybackurls - Fetch URLs from the Wayback Machine.

• waymore - URL discovery from web archives and public datasets.

Google removed the old cache link feature from search results, so avoid relying on Google cache workflows for future investigations.

Website Change Tracking

• Follow That Page - Email alerts for web page changes.

• Visualping - Visual and content change monitoring.

URL Shortening and Redirections

• GrayHatWarfare URL Shorteners - Searches URLs exposed by shortener services.

• urlhunter - Finds URLs exposed through shorteners.

• Unshorten.It - Reveals shortened-link destinations.

• Redirect Detective - Redirect-chain analysis.

• Where Goes? - URL redirect tracing.

• Lookyloo - Web forensics and redirect-chain capture.

Shortener preview tricks:

• bit.ly - Add + to the end of the URL.

• cutt.ly - Add @ to the end of the URL.

• tiny.cc - Add = to the end of the URL.

• tinyurl.com - Add preview. before the host.

Similar Website Search

• SimilarSites

• SitesLike

• Similarweb

Safe Browser Views

• WannaBrowser - View source using different user-agent strings.

• Browserling - Browser testing through hosted browsers.

• URL2PNG - Website screenshots without visiting directly.

Miscellaneous Domain Utilities

• DNPedia - Domain statistics, scripts, news, and tools.

• Google Admin Toolbox Dig - Web-based DNS lookup.

• Backlink Checker - Backlink monitoring.

• DomLink - Finds organization names and email addresses from a domain.

• Unfurl - Breaks down URLs into components.

• r3con1z3r - Web-based footprinting and OSINT CLI.

• theHarvester - Public-source email, host, and subdomain gathering.

• gau - Fetches known URLs from OTX, Wayback Machine, and Common Crawl.

• lbd - Load-balancing detector.

• Metagoofil - Extracts metadata from public documents for a domain.

• Cache Checker - Lists cached web files and cache behavior.

• CloudFlair - Finds possible Cloudflare origin IPs from scan data.

• cf-check - Checks Cloudflare protection.

• AnalyticsRelationships - Finds related domains through shared Google Analytics IDs.

• LOTS Project - Legitimate domains commonly abused for phishing, C2, exfiltration, and malware delivery.

Google Dorking for Domains

• site:example.com - Indexed pages for a domain.

• site:*.example.com - Indexed subdomains.

• site:example.com filetype:pdf - Specific file types.

• site:example.com inurl:admin - Admin-related paths.

• site:example.com intitle:"index of" - Directory listings.

• intext:"example.com" site:pastebin.com - Domain mentions in pastes.

• related:example.com - Similar websites.

Google Dorking

Domain Monitoring

• DomainTools - Domain research, WHOIS history, DNS records, and brand monitoring.

• ExpiredDomains.net - Expiring and deleted domains.

• WhoisXMLAPI Domain Availability API - Domain availability monitoring.

Subdomain takeover testing with nuclei, Subjack, and related tools is offensive validation and belongs with active recon and web application testing.

Reconnaissance and ScanningWeb App Hacking

Deprecated or Offline Tools

• omnisint.io / Project Crobat - Rapid7 DNS dataset service discontinued.

• ThreatCrowd - Offline/deprecated; data migrated to AlienVault OTX.

• tls.bufferover.run - BufferOver services discontinued.

• Riddler.io - Discontinued F-Secure network intelligence API.

• CheckShortURL - Frequently offline/unreliable.

• W3DT - Appears offline.

• DomainIQ - Service unavailable.

• SubOver - No longer maintained; use current takeover detection workflows in active recon.

• Spyse - Rebranded/acquired and no longer the same free OSINT search engine.

• DomainFuzz - Repository appears unavailable.

• Bolster CheckPhish at bolster.ai/checkphish - Not specifically a typosquatting resource.

Investigation Mind Maps