MyRecon OSINTHow to Investigate a Suspicious Domain: A Step-by-Step Guide
Somebody sends you a link, or a domain turns up in a log, and you need to know what it is before anyone acts on it. This is the order to do it in, starting with the checks that need no contact with the site at all, and ending with a judgement you can defend.
Before anything: do not just open it
Almost every step below can be done without loading the page. Do those first, because visiting has consequences: it confirms to the operator that the address they targeted is live, it hands over your IP address and browser fingerprint, and a small number of sites serve something harmful to the first visitor from a given network.
When you do need to see the page, see it somewhere disposable, a virtual machine, a sandboxed browser profile, or an online rendering service that fetches the page and shows you a screenshot. Never open a suspicious link on a phone you use for banking, and never while signed into anything.
If the link is shortened, expand it without following it. Several shorteners will show you the destination if you append a character to the URL, and any link-expander service does the same. A shortener in a message that claims to be from a bank is already an answer of sorts: regulated institutions do not hide their own domain.
Step 1: read the name itself
More fraudulent domains are given away by their own spelling than by anything technical. The only part that matters is the registrable domain: the label immediately before the top-level domain. Everything to the left of it is under the control of whoever owns that name, and that is precisely what the tricks exploit.
- Subdomain dressing. In yourbank.com.account-verify.example, the real domain is account-verify.example. The brand is just a subdomain that anyone may create. Read a hostname right to left.
- Homoglyphs and punycode. Characters from other alphabets can render identically to Latin ones. A domain beginning xn-- in its raw form is an internationalised name, which is entirely legitimate and also how a lookalike is built.
- Typo variants. Doubled letters, dropped letters, rn for m, digits for letters, and inserted hyphens.
- Plausible additions. A brand name plus -secure, -verify, -support or -login. Real companies put those on subdomains of their own domain, not in a new registration.
- The TLD. An established brand's primary presence is rarely on a novelty extension. This is a weak signal on its own and a strong one in combination.
Step 2: the registration record
Look up RDAP. You are after four things: when it was created, when it was last updated, which registrar sold it, and what status codes are set. A domain created days ago that claims to be an established business is the most reliable single finding in this entire process.
Note also what you will not get, a name. Redaction is the norm since 2018 and is not itself suspicious. The WHOIS and RDAP guide covers how to read the record properly, including why an old creation date can be bought.
Step 3: DNS
Pull the zone's records and read them as a description of how much infrastructure actually exists behind the name.
- A and AAAA: where it resolves, and whether that is a CDN standing in front of something else.
- NS: which DNS provider. Unusual nameservers are the best link between separate domains run by the same operator.
- MX: can this domain receive mail at all? A business that cannot receive mail is not a business.
- TXT: verification tokens name the SaaS products the owner signed up for, which is a fair proxy for whether a real organisation stands behind the site.
The DNS guide goes through each type and what it gives away.
Step 4: the mail posture
Check SPF and DMARC specifically. A domain impersonating a bank, with no DMARC policy and a permissive SPF record, is built to send mail as itself and was never configured to stop anyone else doing the same. A domain with a carefully maintained p=reject policy has had someone competent working on it, which does not prove legitimacy but does change the picture. See SPF, DKIM and DMARC.
Step 5: the hosting
Resolve the address and identify the network: the ASN, the organisation, and whether this is mainstream cloud, a small reseller, or a provider with a reputation for not answering abuse reports. Check reverse DNS, and forward-confirm it.
Keep expectations calibrated. Shared hosting and CDNs mean an address is usually shared with thousands of unrelated sites, so "this IP also hosts something bad" is nearly meaningless on its own. Our IP guide covers what an address does and does not establish.
Step 6: the certificate
Every publicly trusted certificate is logged to certificate transparency, and those logs are searchable by domain. Two things come out of that.
First, the issuance date. A certificate issued three days ago for a site claiming a decade of trading is the same finding as a fresh registration, arrived at independently. Second, the other names: certificates list every hostname they cover, and searching the logs for a domain returns subdomains that are otherwise undiscoverable, which often exposes the staging environment, the mail host, or the rest of an operator's estate.
The padlock proves nothing about honesty. A domain-validated certificate attests to one fact: whoever requested it could demonstrate control of the domain. It is free, it is automated, and phishing sites have it because every site has it. HTTPS means the connection is encrypted, not that the destination is trustworthy, and the widespread advice to "look for the padlock" now does more harm than good.
Step 7: the content, viewed safely
Once you are looking at the page in something disposable, the tells are mostly about effort and reuse:
- Copied assets. Logos hotlinked from the real company, or images that reverse-search back to stock libraries and other businesses.
- Boilerplate legal pages naming a different company, a different country, or nobody at all. Fraudulent sites copy these and forget to edit them, and this is one of the most reliable tells there is.
- No verifiable identity. No company number, no registered address, or a number that does not appear in the relevant national companies register. Any real trading entity is on a public register somewhere, and checking takes a minute.
- Contact detail that goes nowhere. A form with no address behind it, a mailbox on a free provider, a phone number that is never answered.
- Dead navigation. Links that go nowhere, because only the pages leading to the payment or login form were ever built.
- Reviews that all arrived at once, in the same register, within days of the domain being registered.
Step 8: the history
Web archives let you see what the domain looked like before. Two patterns matter. A site with no archived history at all, presenting itself as long-established, is contradicting itself. And a domain whose archive shows a completely different business until recently has been re-purposed, either bought for its age or taken over, and both are worth knowing.
Putting it together
No single finding decides it. What decides it is the combination, and these combinations are the ones that recur:
- Very likely fraudulent: registered within weeks, certificate issued at the same time, brand name in a subdomain or a typo variant, no archived history, legal pages naming an unrelated company, no verifiable registration, payment or credentials requested.
- Worth caution, not an accusation: young domain, privacy-protected registration, thin content, a small host, a description that fits a great many legitimate new small businesses.
- Probably fine: years of consistent archived history, a registration and certificate history to match, an identifiable legal entity, mail infrastructure configured properly.
Write down what you checked, not just what you concluded. Domains change, and a judgement with no record behind it cannot be revisited when it turns out to be wrong. Note each finding with the date you observed it. Our guide to verifying an OSINT finding covers the standard of evidence this needs to meet before anyone acts on it.
What not to do
Do not submit fake credentials to see what happens, it can be an offence, it contaminates the evidence, and some kits harvest whatever they receive regardless. Do not scan, probe or attack the site; you will have moved from investigating to intruding, and the line is not where people assume it is. Do not publish an accusation against a named individual on the strength of infrastructure signals, which associate machines rather than people.
Do report it. The registrar's abuse contact is published in the registration record precisely for this, the hosting provider has one too, and browser safe-browsing programmes and national reporting bodies take submissions. A phishing site taken down an hour earlier is a real result.
Run the registration, DNS and IP steps against any domain with the MyRecon domain tool: RDAP record, live DNS, and the hosting network in one pass.