Domain and Infra OSINT: WHOIS, Passive DNS, crt.sh, Shodan, Censys
an organization’s attack surface is mostly things nobody remembers deploying. a forgotten staging box, a dev subdomain with a 2021 cve, an rdp port left open “just for the migration” two years ago. you can map all of it without sending a single packet to the target, because they already told the internet, loudly, in certificate transparency logs and search engines for exposed devices.
step 1: whois and dns, the boring foundation
start with whois (registrar, creation date, nameservers) and dns records. creation date dates the asset, nameservers reveal the dns provider, and the records themselves (a, mx, txt/spf, dmarc) map mail and hosting.
spf and dmarc records are underrated: they list every service allowed to send mail as the domain, which is a free inventory of saas and marketing tools. a missing or weak dmarc is also a defensive finding you should write down.
step 2: the subdomain leak nobody closes (certificate transparency)
every tls certificate issued is logged publicly in certificate transparency (ct) logs. that means every time someone spins up vpn., dev., or staging. and gets a cert, they announce it to the world. crt.sh queries those logs for free.
this is the highest-signal passive step for mapping an org. dns will not list subdomains for you, but ct logs will, going back years, including dead ones that still resolve. for defenders this is terrifying and useful: your shadow it is enumerable by anyone, so enumerate it first and shut down what should not be there.
step 3: what is actually exposed (shodan and censys)
shodan and censys continuously scan the internet and index what they find. instead of you scanning a target (active, noisy, scoped), you query their existing results (passive, quiet). give them an ip or domain and they tell you open ports, service banners, software versions, tls details, and sometimes known cves.
the classics you will find: rdp (3389) open to the world, old openssh, forgotten management interfaces, databases with no auth, expired or self-signed certs on things that should not be public. shodan’s facets and censys’s structured data let you pivot too: find every host with a given cert, a given favicon hash, or a given server banner, which links disparate infrastructure to one owner.
the recon flow
- whois + dns for the foundation and the dns/mail providers
- passive dns to reverse ips into co-hosted domains
- crt.sh for the full subdomain picture, including the forgotten ones
- shodan + censys to see what is exposed and on which versions
- pivot on shared certs, favicons, and banners to link related assets
what defenders can do
- run it on yourself, monthly: crt.sh plus shodan against your own domains is a free external attack-surface scan. the forgotten staging box is always there.
- set up ct monitoring: alerts on new certs for your domain catch both shadow it and phishing lookalikes early.
- close the obvious: no rdp, smb, or database ports facing the internet. ever. put management behind vpn or a jump host.
- monitor shodan for your ranges: it will find your mistakes before an attacker does, if you bother to look.
sloth take
companies spend a fortune on perimeter tools and then leak their entire subdomain list into public certificate logs for free. crt.sh plus shodan is a ten-minute external audit that will embarrass most orgs. do it to yourself before someone does it to you, close the rdp port you forgot about, and stop pretending the internet does not already have a map.
sources
- crt.sh and the Certificate Transparency ecosystem
- Shodan (shodan.io) and Censys (censys.io) host and search documentation
- Passive DNS providers (Farsight DNSDB, SecurityTrails, Validin, Silent Push)
- ICANN WHOIS and DNS fundamentals
- Lab artifacts generated on-box 2026-10-17 (synthetic domains and terminal captures)
