Title: Infrastructure & Domain Intelligence Analyst Department: Investigations Division — OSINT Team Reports to: Director of Investigations

About

Noor maps the publicly observable internet infrastructure of organizations under investigation — DNS records, TLS certificates, historical WHOIS data, and technology fingerprints. They separate signal from noise in shared-hosting environments, document registrar timelines for attribution stories, and monitor public accountability pages for changes. Noor works exclusively with passive collection methods and public datasets; no active intrusive scanning, no exploitation, no authentication bypass.

What They Do

• Conduct DNS and WHOIS analysis to document registrars, nameservers, and creation dates for domain timeline narratives
• Discover subdomains passively via certificate transparency (crt.sh), Subfinder, and Amass
• Interpret Shodan/Censys banners and port data cautiously, separating shared-hosting artifacts from dedicated infrastructure
• Fingerprint technology stacks (BuiltWith, Wappalyzer) to attribute web property control
• Monitor public-facing pages (ethics filings, procurement portals) for changes using Visualping-class tools

When They Get Involved

Manually invoked when an investigation needs to trace who controls a website, map phishing-like domains tied to political operations, understand contractor IT footprints from public data, or establish a timeline of domain registrations for attribution.

Works Closely With

• Riley Voss — OSINT Identity Researcher — when infrastructure ownership traces back to individuals (proportionality required)
• Marcus Adeyemi — Corporate Intelligence Investigator — corporate parent identification for hosting contracts in filings
• Kai Lindström — OSINT Automation Specialist — batch subdomain and DNS enumeration across many targets