Domain, DNS & IP OSINT Tools
Tools for researching who runs a website and where it lives: WHOIS and registration history, DNS records, subdomains, certificates, hosting, and IP reputation. Infrastructure lookups are usually the lowest-risk place to start an investigation because the inputs are public by design.
Filter these in the interactive catalog
8 tools
- Web-CheckAn all-in-one web application for reviewing a website's public technical, security, and privacy signals.
- AbuseIPDBA crowdsourced database of IP addresses reported for spam, brute-force attempts, and other abusive activity.
- CensysInternet intelligence for researching hosts, services, certificates, and publicly exposed infrastructure.
- crt.shSearches public Certificate Transparency logs to reveal certificates and hostnames associated with a domain.
- SubfinderFast passive subdomain enumeration using public sources and configured provider APIs.
- Cloud EnumMulti-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.
- MetabigorOSINT power without API key hassle
- GooFuzzGooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the target's server and by means of advanced Google searches (Google Dorking).
Using domain, dns & ip tools responsibly
- Prefer passive sources (certificate logs, historical DNS, reputation databases) before anything that touches the target directly.
- Record the date of every lookup — DNS, hosting, and WHOIS data change often.
- Port or vulnerability scanning is not passive research; only do it with written authorization.
Guides
- How to Find Subdomains of a Website (Passive OSINT Methods) Find a domain's subdomains without scanning it: certificate transparency logs, passive DNS sources, and how to verify and document what you find.
- How to Investigate a Suspicious Email Address Check whether an email address is risky or part of a phishing attempt: reputation lookups, breach exposure, header analysis, and domain checks.