Profile a domain and its infrastructure
Move from a bare domain to its owner, hosting, related subdomains, and the people or organizations behind it.
- 01
Registration history
WHOIS the domain: creation and expiry dates, registrar, and any registrant details. Note privacy shields and the dates they were applied.
Output: Ownership and age of the domain.
- 02
DNS records
Pull A/AAAA, MX, TXT, and CNAME records. MX and TXT often reveal the real email and hosting providers behind a site.
Output: The service stack.
- 03
Subdomain enumeration
Query certificate-transparency logs and DNS datasets for subdomains — staging sites, admin panels, and mail servers routinely leak there.
Output: The full exposed surface.
- 04
Hosting and neighbours
Resolve the IPs, group them by ASN, and check what else shares the host. Shared infrastructure is a rich pivot.
Output: Network ownership map.
- 05
Fingerprint the site
Identify the CMS, frameworks, and third-party scripts from page source and headers. Version strings hint at the operator’s habits and timeframe.
Output: Technical profile.
- 06
Archive and capture
Check historical snapshots for changed content, then archive the current state as evidence with a timestamp.
Output: A dated evidence capture.
Field notes
- WHOIS privacy does not mean anonymous — creation dates and registrar patterns still cluster related domains.
- Look for look-alike and typo domains registered around the same time; they often belong to the same campaign.
- Only scan ports on systems you are explicitly authorized to test.