OTInstaller
Sign in

Domain investigation playbook

Verified publisher

DNS, subdomains, certificates, history and look-alikes of a domain, passively first

intermediateabout domain11 toolslicence CC-BY-4.0
Contents 5/7
  1. 1 Domain investigation playbook
  2. 2 Scope and legal
  3. 3 DNS records
  4. 4 Subdomains
  5. 5 History
  6. 6 Look-alike domains
  7. 7 Live hosts (active)
Tools (11)

Tools used in this guide

  • dns-records Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA recordsot install osintverse-community/dns-records
  • crtsh-subdomains Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotterot install osintverse-community/crtsh-subdomains
  • subfinder Finds a domain's subdomains passively from dozens of public sourcesot install osintverse-community/subfinder
  • gau Gets every known URL of a domain from the Wayback Machine, Common Crawl, OTX and urlscanot install osintverse-community/gau
  • waybackpy Finds the oldest or newest Wayback Machine capture of a URL, or every archived URL of a siteot install osintverse-community/waybackpy
  • dnstwist Finds registered look-alike domains for phishing, typosquatting and brand impersonationot install osintverse-community/dnstwist
  • httpx Probes a host's web server: status, title, technologies, TLS, CDN and IPot install osintverse-community/httpx
  • tlsx Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARMot install osintverse-community/tlsx
  • tldextract Splits a URL or hostname into subdomain, registered domain and public suffixot install osintverse-community/tldextract
  • checkdmarc Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problemsot install osintverse-community/checkdmarc
  • unfurl Breaks a URL into everything it encodes: timestamps, IDs, search terms, tracking and session dataot install osintverse-community/unfurl

Install them all:

ot guide tools osintverse-community/domain-investigation

History

Web archives keep pages the owner has since removed: old staff lists, product pages, documents, contact details.

Every archived URL

ot run osintverse-community/gau --domain example.com

gau collects the URLs the Wayback Machine, AlienVault OTX and urlscan.io have seen for the domain, with images and fonts left out. Look for:

  • documents (.pdf, .docx, .xlsx): read their metadata with osintverse-community/exif-meta
  • parameters that leak structure (?user=, /api/v1/)
  • paths that no longer exist on the live site

Oldest and newest captures

ot run osintverse-community/waybackpy --url https://example.com --mode oldest
ot run osintverse-community/waybackpy --url https://example.com --mode newest

The oldest capture shows roughly when a site went live and what it was first about, which is useful for a domain that changed owner. --mode known-urls lists everything archived under a URL.

Unpacking URLs

Long tracking and search URLs often encode timestamps and IDs. unfurl decodes them:

ot run osintverse-community/unfurl --url "https://www.google.com/search?q=example&ei=Lp4pYNHzE4mn5NoP8pKTqAw"

Next: look-alike domains.

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/domain-investigation; offline: ot guide get osintverse-community/domain-investigation · Source · Markdown

Esc

Try

↑ ↓ to move↵ to open