playbooks / domain-recon

Domain → owner, infrastructure, related sites

Map who runs a website and what else they run, passively first, using registration records, DNS history, certificates, shared trackers and archives.

start: ◎ domainyields: email, real name, company, ip / asn, url, file / doclevel: intermediate

caution: Everything until the last step is passive. Active probing (crawling, port scanning, screenshotting) touches the target's servers and appears in their logs.

1. 01

   Registration records

   Current WHOIS is usually privacy-redacted. Historical WHOIS from before GDPR (pre-2018) or before privacy was enabled often holds the real registrant name, email and phone. Reverse WHOIS on that email reveals every other domain they registered.

   • ICANN Lookupfreedetails
   • Whoxyfreemiumacct optionalapidetails
   • DomainTools Whoisfreemiumacct optionalapidetails
   • ViewDNS.infofreemiumapidetails

   → can yield: ✉Email ☺Real name ▤Company ◎Domain

2. 02

   DNS history

   Historical A records can reveal the origin IP behind a CDN like Cloudflare, plus earlier hosting providers. MX and TXT records name the email provider and verification tokens for SaaS services.

   • SecurityTrailsfreemiumacct reqapidetails
   • CompleteDNS Historyfreemiumacct optionaldetails
   • DNSDumpsterfreemiumapidetails

   → can yield: ⌖IP / ASN

3. 03

   Certificates and subdomains

   Certificate Transparency logs list every hostname a TLS certificate was issued for, including staging, internal and forgotten subdomains. Subfinder aggregates many passive sources.

   • crt.shfreeossapidetails
   • subfinderfreeacct optionalossclidetails

   → can yield: ◎Domain

4. 04

   Shared trackers and co-hosting

   Sites run by the same operator often share a Google Analytics, AdSense or Tag Manager ID. Search for the ID to find sibling sites. Reverse IP shows other domains on the same server (more meaningful on dedicated hosting than shared).

   • BuiltWithfreemiumacct optionalapiextensiondetails
   • PublicWWWfreemiumacct optionalapidetails
   • host.iofreemiumacct optionalapidetails
   • ViewDNS.infofreemiumapidetails

   → can yield: ◎Domain ⌖IP / ASN

5. 05

   Archived history

   Old versions of the site often name staff, list contact emails and addresses, or show an earlier owner. Pull all known URLs for forgotten files and endpoints.

   • Wayback Machinefreeacct optionalapiextensiondetails
   • archive.todayfreedetails
   • gau (GetAllUrls)freeossclidetails
   • waybackurlsfreeossclidetails

   → can yield: ✉Email ☺Real name ⇗URL ▧File / Doc

6. 06

   Optional active probing

   Only when the engagement allows it. urlscan visits the page from its own infrastructure and records requests, redirects and screenshots. Public scans are visible to anyone, so use a private scan for sensitive cases. httpx and gowitness probe hosts directly.

   • urlscan.iofreemiumacct optionalapidetails
   • httpxfreeactiveossclidetails
   • gowitnessfreeactiveossclidetails

   → can yield: ⌖IP / ASN ⇗URL