Almost every online scam, phishing campaign and fake storefront depends on a domain name, and almost everything a domain exposes is public. Registration data, DNS records, certificates and hosting details can be read without touching the target. This guide covers what each source shows, how investigators connect them, and where the evidence stops.
Registration data: WHOIS and RDAP
When a domain is registered, the registry and the registrar keep a record: the registrar, the creation and expiry dates, the name servers and, historically, the registrant's contact details. WHOIS is the old way to query it, and RDAP is its structured successor. Since data protection rules such as the GDPR took effect, registrant names, emails and addresses are usually redacted or replaced by a privacy service. The creation date, the registrar and the name servers usually remain, and they are often the most useful fields. A domain created days ago that imitates a long-established brand is a classic warning sign.
DNS records
The Domain Name System maps names to the services behind them. The record types worth knowing:
- A and AAAA point a name to an IP address.
- MX lists the mail servers of the domain. A lookalike domain with mail servers set up is probably meant to send or receive mail.
- NS names the servers that answer for the domain.
- CNAME makes one name an alias of another, often pointing at a hosting or content-delivery service.
- TXT holds free-form text. It carries mail-security policy (SPF, DKIM and DMARC) and verification tokens that services ask owners to publish, which can reveal which providers a domain uses.
Reading public DNS records is low-profile, but queries that reach the domain owner's own name servers can appear in their logs.
Passive DNS and history
Passive DNS databases record which addresses a name pointed to over time, and which names pointed to an address. That lets you pivot from one domain to others on the same infrastructure. Use the result with care. Many unrelated sites can share one IP address on shared hosting or behind a content-delivery network, so a shared address alone is not evidence of a shared owner. Shared name servers, shared mail servers and a matching creation pattern are stronger signals.
Certificates
Publicly trusted TLS certificates are recorded in open certificate transparency logs. Searching a domain there shows which certificates were issued for it, and when. That often reveals subdomains the owner never linked anywhere, and one certificate may cover several names that belong together. A certificate issued yesterday for a name that mimics a bank is worth a closer look.
Hosting and network ownership
An IP address maps to a network operator, known as an autonomous system, through public routing and registry data. This tells you who hosts a site, not who runs it. IP geolocation is approximate and reflects the data center rather than the operator, and a reverse proxy or content-delivery network can hide the original server entirely.
Content, history and shared fingerprints
The site itself adds to the picture. Web archives show earlier versions, page source can expose analytics and advertising identifiers that the same owner reuses across sites, and HTTP headers and page structure hint at the software in use. Contact details, wording and images copied from another site are often easier to spot than any technical link.
Spotting lookalike domains
Phishing domains tend to follow a few patterns:
- Typos that swap, drop or double a letter.
- Added words such as secure, login or support next to a brand name.
- Different endings, for example a brand name under an unrelated top-level domain.
- Look-alike characters, where letters from another alphabet that look the same replace Latin ones in an internationalized domain name.
Compare the registration date, the registrar, the hosting and the mail setup with those of the genuine domain. Differences in several of them point the same way.
A worked example
Say reports link a shop site to a wave of fraud complaints. A passive pass could look like this:
- Question: is the site at this address connected to the fraud reports?
- Registration: note the creation date, the registrar and the name servers.
- DNS: record the IP addresses, the mail servers and the text records.
- Certificates: list the issued certificates and the names they cover.
- Pivot: search for other domains on the same name servers or certificates, and discard pivots that are only shared hosting.
- Conclusion: state what links the domains, what does not, and how confident you are.
Limits and ethics
Keep to passive sources. Port scanning, probing for vulnerabilities or trying logins on a site you do not own can be illegal without permission, and it is not OSINT. Infrastructure is not identity: a domain, an IP address or a certificate links machines, not necessarily the people behind them, so describe connections as leads until independent evidence supports a conclusion. Handle any personal data you come across, such as a registrant contact, with the same care as any other personal data. Our Ethical Guidelines set out the uses we do not allow. This is general information, not legal advice.
Where OSINT Search Engine fits
OSINT Search Engine includes domain lookups among its search modules, together with email, phone, username, wallet and image searches. Results are leads to verify. See the OSINT Search page, and read Email OSINT for how a domain fits into an email check.
