Lesson 5.5

Domains, DNS & Internet Infrastructure

Learning Objectives

Look up who registered a domain and read the results after the WHOIS-to-RDAP transition
Explain what each DNS record type reveals about an organization’s services and vendors
Use certificate transparency logs and passive DNS to map subdomains without touching the target
Describe internet-scan search engines (Shodan, Censys, and others) and why searching them is passive
Identify the OPSEC and legal risks of public URL scanners and exposed cloud storage indexes

Why Infrastructure OSINT Is Different

Everything else in this module is about people and content. This file is about the machines: the domains, servers, IP addresses, and services that make up an organization’s internet presence, its attack surface.

The important property: most of this can be gathered passively. Certificate logs, passive DNS databases, and internet-scan engines contain data that someone else already collected by scanning the internet. Querying their copy never touches your target, so it doesn’t show up in the target’s logs. That’s the opposite of running your own port scan, which is active reconnaissance and needs authorization (see Module 4 and Module 2). This file focuses on the passive sources.

Domain Registration: WHOIS and RDAP

When someone registers a domain, registration data is recorded: registrar, creation and expiry dates, name servers, and (historically) the registrant’s contact details.

WHOIS is the old protocol and the word everyone still uses.
RDAP (Registration Data Access Protocol) is the modern replacement. It returns structured JSON, supports internationalization, and allows differentiated access. As of January 28, 2025, ICANN designated RDAP as the definitive source for generic top-level domain (gTLD) registration data and sunset the requirement for legacy WHOIS on gTLDs. In practice both will coexist for a while: many country-code TLDs (ccTLDs) and some registrars still use WHOIS.

What you’ll actually see:
- Registrar, name servers, and creation/expiry/update dates are usually visible.
- Registrant contact details are usually redacted. Since GDPR took effect in 2018, registrars mask personal registrant data behind privacy services. So don’t expect a name and address on most domains.

Where to look:
- ICANN Lookup (lookup.icann.org) is the free, official RDAP-based tool.
- Command-line: whois <domain>, or RDAP via curl / ICANN’s open-source client.
- Historical WHOIS (DomainTools, WhoisXML API; mostly paid) can show older, pre-redaction records, which sometimes reveal the original registrant, an email, or links between domains registered by the same person.

Why it matters: creation dates flag freshly registered domains (a phishing red flag); shared registrant details or name servers can link multiple domains to the same actor; expiry dates hint at abandoned assets.

DNS Records: A Map of an Organization’s Services

The Domain Name System translates names to addresses, but its records also advertise which services and vendors an organization uses. You can query DNS with dig, nslookup, or web tools like DNSDumpster (free).

Record	What it holds	What it reveals
A / AAAA	IPv4 / IPv6 address	Where a hostname points; hosting provider or cloud region
MX	Mail servers	Email provider: e.g., Google Workspace vs. Microsoft 365 vs. Proofpoint
TXT	Text records	SPF/DKIM/DMARC email settings; domain-verification tokens that reveal SaaS tools in use (e.g., `google-site-verification`, `atlassian-domain-verification`, `facebook-domain-verification`)
CNAME	Alias to another name	Third-party services: CDNs, help desks, marketing platforms, status pages
NS	Name servers	Who runs the organization’s DNS
SOA	Zone authority info	Admin email and zone serial
PTR	Reverse DNS (IP → name)	Naming conventions on IP ranges

The TXT-record trick is a favorite: verification tokens are added whenever an organization sets up a new SaaS product, so the TXT records are effectively a list of the cloud tools they’ve onboarded.

Passive vs. active in DNS: simple lookups (A, MX, TXT for a known name) are effectively passive. Brute-forcing subdomains by sending many DNS queries, or attempting a zone transfer, is more active. Prefer passive subdomain discovery (below) unless you’re authorized to be noisy.

Certificate Transparency Logs

Every TLS certificate issued by a publicly trusted authority is recorded in public, append-only Certificate Transparency (CT) logs. This is a goldmine for finding subdomains, because certificates list the exact hostnames they cover.

crt.sh (free web interface) lets you search a domain: querying %.companyx.com returns certificates for subdomains like vpn., dev., staging., jira., mail. — including internal-sounding hosts the organization never linked publicly.
Censys and other tools also index certificates.
Why it’s powerful: an organization can’t hide a subdomain simply by not linking to it; if it has a public certificate, it’s in the logs. This regularly reveals staging and admin environments.

Passive Subdomain Enumeration

Rather than brute-forcing, these tools aggregate subdomains from CT logs, passive DNS, and other public datasets:
- Subfinder, Amass (in passive mode), and theHarvester pull subdomains from many sources at once.
- Passive DNS databases store historical DNS resolutions collected by sensors worldwide, so you can see a domain’s past IP addresses and records without querying it:
- VirusTotal (the “Relations” tab), SecurityTrails (now part of Recorded Future; free tier available), and DNSDumpster.

Internet-Wide Scan Search Engines

These services continuously scan the entire internet, fingerprint what’s listening on each IP, and let you search the results. Because they’ve already done the scanning, searching them is passive for you. They tie into 2.3 IoT Hacking.

Engine	Focus	Free access (verify)
Shodan	Internet-connected devices, service banners, IoT, ICS, webcams	Free is very limited; a one-time paid membership (often ~$49, occasionally discounted) unlocks much more
Censys	Hosts, open ports, certificates	Free tier metered by monthly credits (~100/month)
ZoomEye	Devices and services, strong Asia coverage	Free/points tier allows some scripted search
FOFA	Devices and services, strong Asia coverage	Free/points tier allows some scripted search
GreyNoise	Who is scanning the internet (mostly defensive)	Free Community API: limited lookups (e.g., ~50/week)

Shodan is the classic. You can find exposed databases, remote-desktop services, industrial control systems, and misconfigured devices by service, product, version, port, and location. Attackers use it to find any vulnerable target; defenders use it to find their own exposed services.
GreyNoise flips the perspective: it tells you whether an IP that hit your logs is a mass internet scanner (background “noise”) or something more targeted, which helps analysts triage alerts.
Note on free tiers: these change often, and 2025–2026 saw several tighten. Assume the free tier is smaller than last year’s tutorials claim, and check before class.

IP Ownership and Network Ranges

To learn who owns an IP address or block:
- Regional Internet Registries (RIRs): ARIN (North America), RIPE NCC (Europe/Middle East), APNIC (Asia-Pacific), LACNIC (Latin America), AFRINIC (Africa). Their WHOIS/RDAP tells you which organization holds a given IP block.
- BGP / ASN tools: an organization’s Autonomous System Number (ASN) and the IP ranges it announces reveal the full footprint it routes.
- Hurricane Electric BGP Toolkit (bgp.he.net) is a long-standing free tool for ASN and prefix lookups.
- Note: the popular BGPView service shut down in November 2025; bgp.tools is a common replacement. (Verify current tools before class.)

Website Technology Fingerprinting

Identify what software a website runs:
- BuiltWith: shows current and historical technologies for a site; free lookups are limited and paid plans are expensive (entry around $295/month).
- Wappalyzer: a browser extension that identifies technologies as you visit a site. Because it inspects pages you load, it’s semi-passive. The extension is free; account-based lookups and the API are metered/paid.
- Manual fingerprinting: HTTP response headers, cookie names, /favicon.ico hashes, and error pages all hint at the stack.

URL and Threat-Intel Scanners (and Their OPSEC Trap)

VirusTotal and urlscan.io let you submit a URL and get back screenshots, the domains it contacted, and related infrastructure, plus results from scans other people already ran (which is passive to browse).
The critical OPSEC and privacy risk: scans you submit can be made public. urlscan.io has visibility levels: Public (searchable by anyone), Unlisted (visible to vetted researchers), and Private (only you). Security researchers have repeatedly found sensitive URLs (password-reset links, shared-document links, invoices) exposed on urlscan.io because tools submitted them as public by mistake.
Rule: never submit a sensitive or internal URL as a public scan. Choose private/unlisted, and remember that submitting a target’s private link can leak it to the world. Also, submitting a target’s URL can tip them off if the scanner fetches the page from an identifiable source.

Exposed Cloud Storage

Misconfigured cloud storage (AWS S3 buckets, Azure Blob containers, Google Cloud Storage) set to public exposes files to anyone.
GrayhatWarfare indexes publicly open buckets and lets you search by filename and extension. Free searches are limited; a paid tier (around $25/month) adds filters and exclusions.
Legal caution (Module 2): finding an open bucket in an index is one thing; downloading sensitive data from it can cross legal lines and is not authorized in this class. Note the exposure, report it, and stop.

Bringing It Together (Example)

Starting from just companyx.com, all passively:
- RDAP: domain created 2009, name servers point to a managed DNS provider
- MX records: Microsoft 365; TXT records: verification tokens for Atlassian, Zoom, and DocuSign
- crt.sh: reveals vpn.companyx.com, dev.companyx.com, jira.companyx.com
- Shodan on the VPN’s IP: identifies the VPN product and version
- BGP toolkit: the ASN and full IP ranges the company routes
- BuiltWith: the marketing site runs a specific CMS and analytics stack

The organization now has a mapped attack surface, and not a single packet was sent to its servers by the investigator. A defender doing the same pass finds the forgotten dev. box before an attacker does.

Key Terms

Attack surface: all the internet-facing assets (domains, hosts, services) that could be attacked
WHOIS / RDAP: protocols for looking up domain and IP registration data (RDAP is the modern one)
DNS record types (A, MX, TXT, CNAME, NS): entries that map names to addresses and advertise services
Certificate Transparency (CT) log: a public, append-only record of every issued TLS certificate
Passive DNS: historical DNS data collected by sensors, searchable without querying the target
ASN (Autonomous System Number): an identifier for a network that announces IP ranges via BGP
Banner: the identifying text a service returns, revealing product and version

Key Takeaways

Infrastructure OSINT maps the target’s attack surface, mostly passively
RDAP replaced WHOIS for gTLDs in January 2025; registrant details are usually GDPR-redacted
DNS records reveal vendors: MX = email provider, TXT tokens = SaaS tools in use
Certificate Transparency logs (crt.sh) expose subdomains an org never linked
Shodan/Censys/etc. already scanned the internet, so searching them is passive
Public URL scanners can leak sensitive links: never submit internal URLs as public
Finding exposed cloud storage is not permission to download from it

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.