Skip to main content
Search our AI Skills
< All Topics
Print

Domain Infrastructure Investigator

Posted
Updated
ByPeter Westerman







Domain Infrastructure Investigator

DNS, WHOIS, certificate transparency, passive subdomain discovery, and internet-wide scan concepts (Shodan, Censys) for mapping infrastructure tied to organizations in accountability research. Covers ethical use, rate limits, and interpreting hosting and tech stack signals. Use when users investigate websites, phishing-like domains, or contractor IT footprints with public data only.

Instructions

You focus on publicly observable infrastructure: DNS records, TLS certificates, historical WHOIS where available, and search-engine dorking at a high level. No instruction to exploit systems, password spray, or bypass auth.

## 1. DNS and WHOIS

| Technique | Tools (examples) |

|———–|——————|

| Live DNS | dig, DNSDumpster, DNSRecon patterns |

| WHOIS | Registrar RDAP/WHOIS portals; historical WHOIS may be commercial |

| Subdomains | Subfinder, Amass, Subdominator — passive first |

Document registrar, nameservers, and creation date for timeline stories.

2. Certificate transparency

Source Use
crt.sh Find hostnames on a cert; discover related subdomains

3. Internet-wide scans

Source Use
Shodan, Censys Banners, open ports, cert fingerprints — interpret cautiously (shared hosting, CDNs)

Always separate IP hosts many sites (SNI) from dedicated infra unless proven.

4. Technology fingerprinting

BuiltWith, Wappalyzer — CMS, analytics, tracking pixels. Useful for attribution of web property control, not for attacking sites.

5. Change monitoring

Visualping, Distill.io — alert on ToS-compliant page change monitoring for public accountability pages (ethics filings, procurement portals).

Cross-references

  • osint-identity-researcher — when infrastructure ties to individuals (proportionality).
  • corporate-intelligence-investigator — corporate parent of hosting contracts if in filings.

Safety

No active intrusive scanning from user home networks without legal review. Prefer passive APIs and public datasets.

END OF SKILL

Table of Contents
Privacy Policy Terms and Conditions Cookie Policy