How to Investigate a Domain: WHOIS, DNS and Certificate Records
A domain name looks like a single, opaque string, but registering and running one leaves a trail of records that are public by design: who registered it and when, what servers answer for it, what other names share its infrastructure, and what certificates have ever been issued for it. None of this requires special access — it is published as part of how the domain and certificate systems work — but knowing where to look, and in what order, turns a pile of raw records into an actual picture of what a site is and who is behind it.
What a domain registration reveals — and what it doesn’t anymore
Every registered domain has WHOIS data attached to it: the registrar it was bought through, the date it was first registered and when it is due to expire or renew, and the name servers it currently points to. Historically WHOIS also exposed the registrant’s name, email, and postal address directly.
Most registrars now offer, and in some regions are required to apply, privacy or proxy redaction that replaces those personal fields with the registrar’s own placeholder contact details. So a WHOIS lookup today frequently tells you the registrar, the registration and expiry dates, and the name servers, but not a real name or address behind the domain — treat the absence of registrant details as the default, not as something suspicious in itself.
When registrant details are not redacted, or when a domain was registered before privacy redaction became standard, WHOIS can still directly name an organisation or individual, which is worth checking even though you should not assume it will be there.
What DNS records add on top of WHOIS
Where WHOIS describes the registration, DNS records describe how the domain actually functions. An A or AAAA record points the domain at the IP address serving its content; MX records show which mail servers handle its email; TXT records often contain verification strings for services the domain owner has connected, such as email-sending or hosting platforms; and NS records show which name servers are authoritative for the domain, which can point at a specific hosting or DNS provider.
Looking up a domain’s IP address and then checking what else resolves to that same address can surface other domains hosted on the same server or behind the same infrastructure — useful when a suspicious site is one of several sharing an IP with a common operator, though shared hosting also means an IP address alone is weak evidence of a relationship between two domains, since large hosting providers put many unrelated sites on the same address.
Subdomains and certificate transparency logs
Most domains have subdomains beyond the main site — a mail portal, a staging environment, an API endpoint, an old subdomain nobody decommissioned — and these are not always linked from the site itself. One of the more reliable ways to discover them is through certificate transparency logs: every publicly trusted TLS certificate issued for a domain, including ones for its subdomains, is recorded in public, append-only logs that certificate authorities are required to submit to.
Searching a certificate transparency log for a domain returns every certificate ever issued for it and its subdomains, which is often the fastest way to enumerate subdomains a site operator did not intend to advertise. A subdomain showing up in these logs does not mean it is currently live or still resolves to anything, only that a certificate was issued for it at some point.
Historical records: what a domain used to be
Domains change hands, change hosting, and change purpose over time, and current WHOIS and DNS records only show the present state. Historical WHOIS and DNS records — where a service has archived past lookups — can show a different registrant, a different set of name servers, or a completely different site under the same domain at an earlier point, which matters when trying to work out whether a domain has always been run by the same party or was repurposed after expiring or being sold.
This kind of history is particularly relevant for domains that look newly suspicious: an otherwise ordinary-looking domain that changed registrant and hosting a few months before it started being used for something questionable tells a very different story than one that has been consistent for years.
A practical order of operations for checking a suspicious site
Start with WHOIS to establish the basics: how old the domain is, who it is registered through, and whether registrant details are visible or redacted. A domain registered only days or weeks before it started being used, especially alongside a low-cost or privacy-focused registrar, is a mild caution signal on its own, though plenty of legitimate sites also use privacy redaction and recent registrations, so weigh it alongside everything else rather than treating it as decisive by itself.
Next check the DNS records to see what is actually serving the site and where its email, if any, is handled, then check certificate transparency logs for subdomains that might reveal a login portal, admin panel, or staging copy of the site not linked from the homepage. Finally, if the domain’s current story does not add up, check historical records to see whether it has a longer, different history that current records alone would not show.
None of these checks individually proves a site is malicious or legitimate — each one adds a data point, and the overall picture is built by combining them, the same way it is with any other OSINT technique.
Tools for this
Related on this site
Common questions
Why can’t I see the registrant’s name in WHOIS anymore?
Most registrars now apply privacy or proxy redaction by default, which replaces personal registrant fields with the registrar’s own placeholder contact details. This is the normal state for most domains today rather than a sign that something is being hidden.
Is a newly registered domain automatically suspicious?
No. A recent registration date is only a mild, contextual signal, and plenty of legitimate new sites are registered every day. It only becomes more meaningful alongside other signals, such as the domain’s content, hosting, and how it is being promoted or linked to you.
What is a certificate transparency log?
It is a public, append-only record of TLS certificates issued for domains, which certificate authorities are required to submit to. Searching it for a domain can reveal subdomains that were never linked from the main site.
Does a subdomain showing up in a certificate log mean it is still live?
Not necessarily. It only means a certificate was issued for that name at some point; the subdomain may no longer resolve to anything or may have been decommissioned since.
Can domain investigation techniques identify a specific person?
Sometimes, when registrant details are not redacted, but often the most they reveal is a registrar, hosting provider, and infrastructure pattern rather than a named individual. Treat what any single lookup shows as a starting point, not a conclusion.