Domain

Domain Registration Analysis

WHOIS gives you details about domain registration dates, which can be interesting when you're investigating potential scams or cyber threats. Although privacy protection has made current WHOIS data less transparent, historical WHOIS records can still yield contact information like email addresses and phone numbers.

WHOIS Lookup

Comprehensive WHOIS lookup tool

whois.domaintools.com

Historical Analysis

The Internet Archive's Wayback Machine is one of the most useful tools, capturing snapshots of websites over time. It allows you to track changes in content, discover removed information, and observe the evolution of a website. Historical insights can shed light on past modifications which could give you information about removed pages as well.

Wayback Machine

Access archived versions of websites

web.archive.org

Cloud Storage Investigation

Most of the companies use cloud storage solutions, which can sometimes be exposed. You can discover publicly accessible AWS S3 buckets, Azure Blobs, and Google Cloud Storage containers that might contain sensitive information (private pdfs, images, etc..).

Tracking Connections

When you want to discover links between websites or discover other related websites, do not forget to look for tracking codes. Google Analytics and AdSense IDs often link multiple domains to the same owner or organization.
To find tracking codes, right-click on the webpage, select "View Page Source", and use CTRL+F to search for specific patterns:

// Look for these in the page source
G-XXXXXXXXXX      // Modern GA4
UA-XXXXXX-X       // Legacy Analytics
ca-pub-XXXXXXXXXX // AdSense

Subdomain Enumeration

Subdomain enumeration is a wide topic, a lot of tools and techniques exists (if you want to only retrieve subdomains using OSINT techniques, be careful with the tool you use). You can retrieve subdomains using :

• Certificate transparency logs, like crt.sh. When a website is registered, it has to be issued a SSL certificate by a Certificate Authority, and this certificate is recorded in a log. This way, you can retrieve subdomains from the logs. If you want to avoid your domains to be recorded I recommand you to use a wildcard certificate (such as *.hippie.cat).


crt.sh hippie.cat

• Google dorks such as site:example.com
• DNS records

Find sensitive information through dorks

Google dorking remains a powerful technique for discovering exposed documents, logs, and sensitive information. Here are a few dorks examples that you can use on a domain :

site:example.com filetype:pdf OR filetype:xlsx   # find pdf or xlsx files
site:example.com intext:password                 # find password in the text of the page
link:example.com -site:example.com               # find website links to the domain

If you are lazy to create a specific dork, you can use DorkGPT, an AI-powered tool that generates precise search queries.

DorkGPT

AI-powered Google dorking query generator

www.dorkgpt.com

Data Breach Investigation

Data breaches allows you to obtain sensitive information about people on a domain, it's pretty useful for red teaming or social engineering. Leaked data can provide information about domain owners and associated accounts as well.