> DNS, RDAP, Certificate Transparency, passive DNS, exposed services and reputation feeds: a passive method for analysing a domain or IP. Blog · [Domain and IP recon](https://pandorasearch.com/blog/topic/domain-ip-recon/) # Domain and IP reconnaissance with open sources 26 October 2026 · 6 min read A domain or an IP address is often where a security investigation begins: the link in a phishing email, an address in your firewall logs, a new supplier's website. You do not need to touch their systems to understand what is behind them. Public records, and data others have already collected, tell you most of what you need. This article sets out a passive, six-step approach, from what a domain publishes today to what its history and reputation say. ## What it is for - **Incident response and phishing analysis.** What a suspicious domain is, who hosts it and whether it is part of a campaign. - **Your own attack surface.** Which subdomains, services and certificates of your organisation are visible from outside. - **Threat intelligence.** Linking infrastructure: which other domains share an IP, certificates or history. - **Technical due diligence.** Checking a supplier's basic hygiene before you connect it to your systems. ## Passive before active Passive reconnaissance queries public records and datasets that others have collected: DNS, certificate logs, passive DNS, the scans Shodan publishes. Active reconnaissance interacts with the target: scanning ports, probing services, testing for vulnerabilities. Active work requires the owner's authorisation. Pandora is passive: it scans nothing and reads what other sources have already observed. ## Step 1: today's DNS DNS records describe a domain's current infrastructure: - **A and AAAA:** the IP addresses the website points to. - **MX:** who receives its mail. - **NS:** who serves its DNS. - **CNAME:** aliases to other services, such as a CDN or a third-party platform. - **TXT:** the SPF policy and service verification tokens. - **CAA:** which certificate authorities may issue certificates for the domain. TXT records are often the most revealing. The SPF policy lists the providers allowed to send mail on the domain's behalf, and verification tokens give away the services an organisation uses: Google Workspace, Microsoft 365, marketing or support tools. In your own organisation, review your CNAME records too. One that points to a third-party service you no longer use may allow someone else to claim that resource and serve content under your domain. ## Step 2: RDAP and WHOIS RDAP is the structured successor to WHOIS. It returns, as JSON, the registrar, the registration, renewal and expiry dates, the domain's status and its name servers. For generic top-level domains, ICANN has made it the authoritative source. Since the GDPR took effect in 2018, most registrars redact registrant details. Even so, the registration date is one of the most useful data points in the whole analysis: a domain registered two days ago that imitates a bank says a lot on its own. ## Step 3: Certificate Transparency Certificate authorities record every TLS certificate they issue in public, append-only logs, and the major browsers require certificates to appear in them. Search services such as crt.sh and Certspotter let you query those logs by domain. What you get: - **Subdomains**, including internal names someone exposed when requesting a certificate: "vpn", "staging", "intranet". - **The date of the first certificate**, another clue to how long a service has really existed. - **Certificates for lookalike domains**, which in phishing often appear on the very day a campaign is set up. Two limits: wildcard certificates (`*.domain`) do not reveal specific names, and a subdomain appearing in the logs does not mean it is still live. ## Step 4: passive DNS, the domain's history Passive DNS sensors record the resolutions they observe over time. They answer two questions that current DNS cannot: - **Which IPs did this domain point to before?** Useful for reconstructing an incident, or for finding where a malicious site was hosted before it moved behind a CDN. - **Which other domains pointed to this IP?** Useful for mapping a campaign's infrastructure. Be careful with shared hosting: thousands of unrelated websites can sit on a single hosting provider's IP. Sources such as mnemonic, Robtex and AlienVault OTX provide passive DNS data with the first and last time each resolution was seen. ## Step 5: exposed services Shodan continuously scans the internet and publishes what it sees. Its free InternetDB returns, for an IP, the open ports, the software detected, known vulnerabilities associated with that software, and hostnames. The full Shodan API adds detail service by service: product, version, web page title and certificate. Other sources fill in the picture: - **RIPEstat:** the network prefix, the autonomous system, its holder and the abuse contact. - **GreyNoise:** whether the IP is mass-scanning the internet or belongs to a common, well-known service. - **Geolocation and IP databases:** the country and approximate city, the provider, and whether the address belongs to a data centre, a VPN or a Tor exit node. The city is an approximation, not a location. Bear in mind that this data is days or weeks old, and that a vulnerability inferred from a version number can be a false positive if the vendor backported the fix without changing the version. ## Step 6: reputation Reputation sources collect what the security community has seen: - **AlienVault OTX:** threat reports ("pulses") that mention the domain or IP, with malware families, threat groups and tags. - **abuse.ch:** URLhaus, which tracks malware distribution URLs, and ThreatFox, which collects indicators of compromise. - **AbuseIPDB:** community reports of attacks, spam or scanning, with a score from 0 to 100. - **VirusTotal:** verdicts from dozens of security engines. Reputation is context, not a verdict. A shared IP collects reports caused by other customers of the same provider; a legitimate domain can appear in a report because some malware used a well-known service; and a clean result does not mean something is safe. Check the dates: a two-year-old report about a dynamic IP says little about today. ## Putting it together: phishing triage An example of the order of work, without real data: 1. The link in the email leads to a domain that resembles your company's. 2. RDAP: registered three days ago. 3. DNS: it points to a hosting provider's IP and has MX records, so it can receive victims' replies. 4. Certificate Transparency: its certificate was issued the same day, along with others for variants of the name. 5. Passive DNS: the IP previously hosted other domains following the same pattern. 6. Reputation: one of them appears in a phishing feed. That is enough to block the domain, notify the registrar and the hosting provider's abuse contact, and look for variants that have not been used yet. No single signal decides the matter. A recent domain is not malicious just because it is new, and an old one is not safe by definition: expired domains get re-registered and inherit whatever trust the name had built up. What counts is several independent signals pointing the same way. ## How Pandora presents it When you enter a domain or an IP, Pandora runs the automatic sweep: DNS, RDAP, Certificate Transparency, passive DNS, phishing feeds, OTX, InternetDB, RIPEstat and its local IP databases, which flag Tor exit nodes, VPNs, data centres and reputation lists. For the starting domain, it also looks for registered lookalike variants of the name, in the style of dnstwist. The Dossier gathers the flagged IPs and domains, each with the source that flagged it, and the timeline places domain registrations alongside the case's other dates. ## Legal and ethical note Querying passive sources is generally legitimate, but the limits are clear. An IP address can be personal data, as the Court of Justice of the EU recognised in the Breyer case (2016). Scanning or testing systems without authorisation can be a criminal offence, under Spain's Criminal Code or the UK's Computer Misuse Act 1990, for example. And an exposed service is not an invitation: if you find an open database, do not open it; report it through a responsible disclosure channel. This article is not legal advice. ## Frequently asked questions **What is the difference between WHOIS and RDAP?** Both return a domain's registration data. RDAP is the structured successor to WHOIS: it answers in JSON with a common format, and it is now the authoritative source for generic top-level domains. **Is it legal to look up the open ports of an IP address?** Querying databases that already publish that information, such as Shodan InternetDB, is passive reconnaissance. Scanning other people's systems yourself, or connecting to their services without authorisation, is a different matter and can be a crime. **What is passive DNS?** A historical record of DNS resolutions observed by sensors. It shows which IPs a domain pointed to in the past and which domains pointed to an IP, with the first and last time each was seen. **Is an IP address with a bad reputation always malicious?** No. Shared hosting and CDN addresses collect reports caused by other customers, and the data ages. Reputation is context, and it has to be read alongside its dates. **Analyse a domain or IP address in Pandora without touching its systems.** Every new account gets 3 trial searches, with no card. [See plans and pricing](https://pandorasearch.com/pricing/) Tags: domains IP addresses cybersecurity threat intelligence OSINT ## Keep reading - [How to investigate an email address with OSINT](https://pandorasearch.com/blog/how-to-investigate-an-email-address-with-osint/): What open sources reveal about an email address: provider and MX, Gravatar, registered services, breach exposure, and how to corroborate it. - [Checking breach exposure without touching passwords](https://pandorasearch.com/blog/check-breach-exposure-without-touching-passwords/): Using Have I Been Pwned, XposedOrNot and LeakCheck to measure an email's breach exposure, and why handling leaked passwords crosses a line. - [OSINT and the GDPR: investigating within the law](https://pandorasearch.com/blog/osint-and-gdpr-investigating-within-the-law/): Lawful basis, purpose limitation, minimisation, special categories and audit trails: how to apply the GDPR to an OSINT investigation. [All articles on Domain and IP recon](https://pandorasearch.com/blog/topic/domain-ip-recon/) --- Page: https://pandorasearch.com/blog/domain-and-ip-reconnaissance/