How to Investigate a Suspicious Website: Domain OSINT Guide
Learn step-by-step techniques for investigating scam websites, from WHOIS and DNS records to hosting history and registration patterns.
When a new platform suddenly appears promising guaranteed returns or mimicking a well-known brand, investigators need facts fast. A website's infrastructure often reveals what its marketing tries to hide. Evaluating a suspicious domain requires digging into its registration, hosting, and cryptographic history.
Step 1: WHOIS and RDAP Analysis
The first step in any domain investigation is checking the WHOIS and RDAP records. While privacy protections have obscured many registrant details in recent years, these records still provide critical metadata.
- •Registration Date: Scam domains are often newly registered. A crypto exchange claiming a 10-year history but registered last month is an immediate red flag.
- •Registrar Selection: Fraudulent sites frequently use specific offshore registrars known for ignoring abuse complaints.
- •Status Codes: Note the domain statuses. A lack of ClientTransferProhibited or similar locks can indicate a poorly secured or temporary setup.
Step 2: DNS Records and Infrastructure
DNS records map the domain's logical connections. Querying A, MX, TXT, and NS records helps build a profile of the underlying infrastructure.
Analyzing Nameservers (NS)
Nameservers point to the hosting or DNS provider. Many scams use cheap or free tiers of popular CDNs to hide their true origin IP. However, unique or custom nameservers can sometimes be pivoted on to find other connected domains.
Mail Exchange (MX) and Text (TXT) Records
MX records show where email is routed. Scam sites often lack MX records entirely or use disposable email providers. TXT records might contain site verification strings (like Google Site Verification) that can be linked to other properties owned by the same actor.
Step 3: Historical Hosting and Passive DNS
Threat actors frequently move their sites. Passive DNS databases record historical IP resolutions, allowing you to see where a domain was hosted previously.
If a domain currently resolves to a CDN like Cloudflare, checking passive DNS might reveal its original, exposed server IP from before the CDN was activated. Once you have an origin IP, you can search for other malicious domains hosted on that same server.
Step 4: Certificate Transparency (CT) Logs
Every public SSL/TLS certificate issued by a trusted Certificate Authority is logged publicly. Searching CT logs for a suspicious domain can reveal:
- •Subdomains used for development, admin panels, or staging that the operators didn't intend to make public.
- •Other domains included in multi-domain (SAN) certificates, immediately linking the scam to other operations.
Step 5: Content and Source Code Analysis
Scam operators are often lazy. They copy and paste templates, terms of service, and even code structures. Search for unique strings from the site's footer or privacy policy in search engines to find identical clone sites.
Inspect the source code for hidden tracking IDs, such as Google Analytics (UA- or G- tags). Finding a shared tracking ID across multiple domains proves they are operated by the same entity.
Automate Domain Intelligence with Aletheia
Aletheia automatically aggregates WHOIS, DNS history, and certificate transparency logs into a single view, rapidly identifying hidden connections and infrastructure overlaps in suspicious domains.