OTInstaller
Sign in

Domain investigation playbook

Verified publisher

DNS, subdomains, certificates, history and look-alikes of a domain, passively first

intermediateabout domain11 toolslicence CC-BY-4.0
Contents 7/7
  1. 1 Domain investigation playbook
  2. 2 Scope and legal
  3. 3 DNS records
  4. 4 Subdomains
  5. 5 History
  6. 6 Look-alike domains
  7. 7 Live hosts (active)
Tools (11)

Tools used in this guide

  • dns-records Looks up a domain's A, AAAA, CNAME, MX, NS, TXT, SOA and CAA recordsot install osintverse-community/dns-records
  • crtsh-subdomains Finds a domain's subdomains in Certificate Transparency logs through crt.sh or Cert Spotterot install osintverse-community/crtsh-subdomains
  • subfinder Finds a domain's subdomains passively from dozens of public sourcesot install osintverse-community/subfinder
  • gau Gets every known URL of a domain from the Wayback Machine, Common Crawl, OTX and urlscanot install osintverse-community/gau
  • waybackpy Finds the oldest or newest Wayback Machine capture of a URL, or every archived URL of a siteot install osintverse-community/waybackpy
  • dnstwist Finds registered look-alike domains for phishing, typosquatting and brand impersonationot install osintverse-community/dnstwist
  • httpx Probes a host's web server: status, title, technologies, TLS, CDN and IPot install osintverse-community/httpx
  • tlsx Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARMot install osintverse-community/tlsx
  • tldextract Splits a URL or hostname into subdomain, registered domain and public suffixot install osintverse-community/tldextract
  • checkdmarc Checks a domain's SPF, DMARC, MX, BIMI and DNSSEC records and reports problemsot install osintverse-community/checkdmarc
  • unfurl Breaks a URL into everything it encodes: timestamps, IDs, search terms, tracking and session dataot install osintverse-community/unfurl

Install them all:

ot guide tools osintverse-community/domain-investigation

Live hosts (active)

Warning

This step sends requests to the target's servers. Do it only within your scope.

What a web server runs

ot run osintverse-community/httpx --target https://example.com

httpx reports the status code, page title, server software and detected technologies (CMS, frameworks, analytics), the IP and whether a CDN is in front. Titles and technologies are a quick way to sort a long subdomain list into "login portal", "default page", "marketing site" and "API".

What certificate it presents

ot run osintverse-community/tlsx --host example.com

The certificate's subject alternative names often list other domains served from the same machine, a strong pivot to infrastructure owned by the same operator. The issuer and validity dates help date the setup.

Wrap-up

You now have the domain's DNS, its subdomains (current and historical), archived content, look-alikes, and what the live servers run. Continue with the IPs in the IP playbook.

Published 20 Oct 2026. Read it in a terminal: ot guide read osintverse-community/domain-investigation; offline: ot guide get osintverse-community/domain-investigation · Source · Markdown

Esc

Try

↑ ↓ to move↵ to open