The not yet exploited goldmine of osint: Opportunities, open challenges and future trends

H. DOMAIN NAME TECHNIQUE

A typical point of interest in OSINT investigations are web

pages. They can reveal interesting information about our

target, specially whether we are dealing with a person or a

company. It is worth noting that the majority of techniques

which are explained for IP addresses are also suitable in this

context. In addition to them, we can highlight some other

services as presented in TABLE 9.

DNS Trails

extracts DNS records, but also identifies the

number of additional domains that are related to the encoun-

tered results. To this extent, it is a very helpful way to find

relationships and connections. Whoisoly also shows a cross-

reference view from the owner name, address, telephone

number or email address.

Another powerful service is Wayback Machine, which pe-

riodically makes backups of many websites from the whole

Internet. This allows an investigator to analyze the evolution

and changes of a website, being able to see it for particular

screenshots dated in time.

Furthermore, it is possible to visualize domain connections

through Visual Site Mapper or Threat Crowd. Checking DNS

and mailservers is also useful by visiting Whois, which also

offers a ping functionality for checking the connectivity

and a traceroute functionality to study the data path to

the given domain. There are also services like Alexa and

SimilarWeb

which calculate traffic statics and others like

FindSubdomains

which search for subdomains.

VOLUME 4, 2016

11

---

This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI

10.1109/ACCESS.2020.2965257, IEEE Access

J. Pastor-Galindo et al.: The not yet exploited goldmine of OSINT: Opportunities, open challenges and future trends

Domain name OSINT service

URL

Main output

DNS Trails

securitytrails.com/dns-trails

DNS records and related domains

Whoisoly

whoisology.com

Personal or company information

Wayback Machine

web.archive.org/web

Backups of websites

Visual Site Mapper

visualsitemapper.com

Map of subdomains

Threat Crowd

threatcrowd.org

Whois

who.is

Registration info and DNS records

Alexa

alexa.com

Traffic statics

SimilarWeb

similarweb.com

FindSubdomains

findsubdomains.com

Subdomains