Investigate domains with OSINT tools. Start with WHOIS and DNS, then pivot into infrastructure, hosting history, and reputation signals to uncover ownership, relationships, and threats.
Begin with WHOIS and DNS visibility, then pivot into infrastructure, hosting history, and reputation signals.
Establish when the domain was registered, where records point, and how they changed over time.
Use CT logs and host datasets to reveal sibling hosts, certificates, and hidden infrastructure.
Identify hosting, exposed services, shared fingerprints, and technical dependencies.
Use archives and caches to find removed pages, earlier owners, and old contact details.
Establish when the domain was registered, where records point, and how they changed over time.
ArchiveBox is self-hosted open-source web archiving for preserving websites, social posts, and online evidence for investigations.
Internet-wide search interface for hosts and certificates with large-scale host, service, and virtual host coverage plus API access.
Free DNS, WHOIS, and email-authentication lookups for any domain: SPF analysis with the 10-lookup limit check, DKIM selector discovery, DMARC checks, email header analysis, and blacklist checks. Results explain in plain English what each record means. No account needed for basic lookups; free API tier available.
Hunchly automatically captures and preserves web pages and social media content during investigative browsing sessions as evidence.
We offer a vast range of IP address tools to discover details about IP addresses. IP blacklist check, whois lookup, dns lookup, ping, and more!
SecurityTrails provides historical DNS records, WHOIS history, subdomain enumeration, and IP intelligence for domain and infrastructure investigation.
Use CT logs and host datasets to reveal sibling hosts, certificates, and hidden infrastructure.
DNS History archives historical DNS records, letting investigators track IP changes, hosting migrations, and infrastructure pivots over time.
Identify hosting, exposed services, shared fingerprints, and technical dependencies.
Move only when the pivot is explainable. Save useful tools with the plus button, then export the case file when the chain is ready.
Record the exact username, domain, email, image, wallet, or location searched.
Keep source URL, collection timestamp, and any archive timestamp separate.
Quote or summarize what the tool returned before interpreting it.
Mark whether the result is confirmed evidence, a probable link, or only a lead.
