OTInstaller
Sign in

Domain investigation playbook

Verified publisher

DNS, subdomains, certificates, history and look-alikes of a domain, passively first

intermediateabout domain11 toolslicence CC-BY-4.0
Contents 1/7
  1. 1 Domain investigation playbook
  2. 2 Scope and legal
  3. 3 DNS records
  4. 4 Subdomains
  5. 5 History
  6. 6 Look-alike domains
  7. 7 Live hosts (active)
Tools (11)

Tools used in this guide

  • dns-records Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA recordsot install osintverse-community/dns-records
  • crtsh-subdomains Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotterot install osintverse-community/crtsh-subdomains
  • subfinder Finds a domain's subdomains passively from dozens of public sourcesot install osintverse-community/subfinder
  • gau Gets every known URL of a domain from the Wayback Machine, Common Crawl, OTX and urlscanot install osintverse-community/gau
  • waybackpy Finds the oldest or newest Wayback Machine capture of a URL, or every archived URL of a siteot install osintverse-community/waybackpy
  • dnstwist Finds registered look-alike domains for phishing, typosquatting and brand impersonationot install osintverse-community/dnstwist
  • httpx Probes a host's web server: status, title, technologies, TLS, CDN and IPot install osintverse-community/httpx
  • tlsx Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARMot install osintverse-community/tlsx
  • tldextract Splits a URL or hostname into subdomain, registered domain and public suffixot install osintverse-community/tldextract
  • checkdmarc Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problemsot install osintverse-community/checkdmarc
  • unfurl Breaks a URL into everything it encodes: timestamps, IDs, search terms, tracking and session dataot install osintverse-community/unfurl

Install them all:

ot guide tools osintverse-community/domain-investigation

A domain is a public record with a long memory: DNS, TLS certificates and web archives show what an organisation runs, what it ran in the past, and who it shares infrastructure with. Everything in this playbook is passive except the last optional step, which visits the domain's own web servers.

Steps

  1. Scope and legal
  2. DNS records
  3. Subdomains from certificates and passive sources
  4. History: archived URLs and old captures
  5. Look-alike domains
  6. Live hosts (active)

Tools used (ot guide tools osintverse-community/domain-investigation):

Tool Used for
osintverse-community/dns-records A, MX, NS, TXT and other records
osintverse-community/crtsh-subdomains Names from Certificate Transparency
osintverse-community/subfinder Subdomains from dozens of passive sources
osintverse-community/gau Every archived URL of the domain
osintverse-community/waybackpy The oldest and newest captures
osintverse-community/dnstwist Registered look-alike domains
osintverse-community/httpx What the live web servers run
osintverse-community/tlsx The certificate a server presents
osintverse-community/tldextract Splitting URLs into registered domain and subdomain

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/domain-investigation; offline: ot guide get osintverse-community/domain-investigation · Source · Markdown

Esc

Try

↑ ↓ to move↵ to open