Mapping a domain's infrastructure — footprinting — reveals the servers, subdomains, and related properties behind an organisation. It underpins both due diligence and defensive attack-surface mapping. This method builds the fullest possible picture from public sources.
What you'll need
- The target domain
- Domain and DNS tools from the Domain Names & Usernames category
- Dataset and infrastructure sources from the Data Acquisition category
Steps
- Read the registration record. Start with WHOIS to see the registrar, creation date, and — where not masked — registrant details. Historical WHOIS can reveal the original owner behind a privacy service.
- Enumerate DNS records. Pull the domain's A, MX, TXT, and name-server records. MX records reveal the mail provider; TXT records often expose the third-party services the organisation uses.
- Discover subdomains via certificate transparency. Search certificate-transparency logs, which record every TLS certificate issued and name the domains they cover. This is the most effective way to find forgotten or internal-looking subdomains.
- Cross-check with subdomain tools. Complement CT logs with dedicated subdomain-enumeration tools to catch subdomains not covered by a certificate.
- Resolve and group by infrastructure. Resolve the discovered hosts to IP addresses, then group them by network and hosting provider (autonomous system) to see which assets sit together and who operates them.
- Check archives and history. Web archives show what subdomains and content existed in the past, often revealing infrastructure that has since been hidden.
Common pitfalls
- Stopping at one source. No single tool finds every subdomain; combine CT logs, DNS, and dedicated tools.
- Confusing shared hosting with ownership. Many sites share an IP; a shared address does not prove common ownership without corroboration.
- Crossing into active testing. OSINT footprinting uses public data only — do not probe, scan, or access systems you are not authorised to.
Verify your result
You have mapped the infrastructure when you can present a documented list of the domain's subdomains, mail and service providers, and hosting, each traceable to a public source. A relationship diagram grouping assets by provider makes the footprint legible and defensible.