Skill: domain-infrastructure-investigator
Time: ~20 minutes

Goal

See where a domain points and who registered it — using lawful queries only.

Steps

1. Run dig +short A and MX for the domain (or use a reputable web DNS tool).
2. Check TLS certificate transparency logs for subdomains (crt.sh).
3. Query WHOIS via RDAP where available; note registrar and dates.
4. Respect GDPR redaction — absence of fields is normal.
5. Log timestamp of query; WHOIS data changes.
6. Do not run aggressive scanning without authorization.

Pitfalls

• Privacy proxy is not proof of wrongdoing.
• Shared hosting IP ≠ co-ownership.

Next steps

• Tutorial — SpiderFoot recon overview for orchestrated OSINT (policy permitting)