OSINT Bible 7. Domain / IP / DNS
Objective Tool Quick Command
Subdomains Amass 'amass enum -d target.com -o subs.txt'
Certificates CRT.sh 'curl https://crt.sh/?q=%25.target.com&output=json'
Historical DNS SecurityTrails https://securitytrails.com Free API 50/month
Neighbor IPs BGP.he https://bgp.he.net CIDR
Reputation VirusTotal https://virustotal.com 'vt ip_info '
Quick scan Nmap-online https://nmap.online no VPN
Subdomains Subdomain Center 'https://www.subdomain.center'
Subdomains SubdomainRadar 'https://www.subdomainradar.io'
Historical DNS DNSTrails 'https://dnstrails.com/'
Historical DNS DNS History 'http://dnshistory.org'
Reputation Talos 'https://www.talosintelligence.com/'
Scan Binary Defense 'https://www.binarydefense.com/banlist.txt'
BGP Ranking CIRCL BGP 'https://bgpranking.circl.lu'
Botnet Tracker MalwareTech 'https://intel.malwaretech.com/'
BOTVRIJ.EU BOTVRIJ 'http://www.botvrij.eu/'
C&C Tracker Bambenek 'http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt'
CertStream CertStream 'https://certstream.calidog.io/'
CCSS Forum CCSS Forum 'http://www.ccssforum.org/malware-certificates.php'
CI Army List CINS Score 'http://cinsscore.com/#list'
Cisco Umbrella Cisco Umbrella 'http://s3-us-west-1.amazonaws.com/umbrella-static/index.html'
Cloudmersive Cloudmersive 'https://cloudmersive.com/virus-api'
Critical Stack Critical Stack 'https://intelstack.com/'
CrowdSec CrowdSec 'https://app.crowdsec.net/'
Cyber Cure Cyber Cure 'https://www.cybercure.ai/'
Cyware Cyware 'https://cyware.com/community/ctix-feeds'
DataPlane DataPlane 'https://dataplane.org/'
Focsec Focsec 'https://focsec.com'
DigitalSide DigitalSide 'https://osint.digitalside.it/'
Disposable Domains Disposable Domains 'https://github.com/martenson/disposable-email-domains'
Emerging Threats Emerging Threats 'http://rules.emergingthreats.net/fwrules/'
ExoneraTor ExoneraTor 'https://exonerator.torproject.org/'
Exploitalert Exploitalert 'http://www.exploitalert.com/'
FastIntercept FastIntercept 'https://intercept.sh/threatlists/'
Feodo Tracker Feodo Tracker 'https://feodotracker.abuse.ch/'
FireHOL FireHOL 'http://iplists.firehol.org/'
FraudGuard FraudGuard 'https://fraudguard.io/'
Grey Noise Grey Noise 'http://greynoise.io/'
Hail a TAXII Hail a TAXII 'http://hailataxii.com/'
HoneyDB HoneyDB 'https://riskdiscovery.com/honeydb/'
Icewater Icewater 'https://github.com/SupportIntelligence/Icewater'
Infosec CERT-PA Infosec CERT-PA 'https://infosec.cert-pa.it'
InQuest Labs InQuest Labs 'https://labs.inquest.net'
I-Blocklist I-Blocklist 'https://www.iblocklist.com/lists'
IPsum IPsum 'https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt'
James Brine James Brine 'https://jamesbrine.com.au'
Kaspersky Feeds Kaspersky 'https://support.kaspersky.com/datafeeds'
Maldatabase Maldatabase 'https://malcore.io'
Malpedia Malpedia 'https://malpedia.caad.fkie.fraunhofer.de/'
MalShare MalShare 'http://www.malshare.com/'
Maltiverse Maltiverse 'https://www.maltiverse.com/'
MalwareBazaar MalwareBazaar 'https://bazaar.abuse.ch/'
Malware Domain List Malware Domain List 'https://www.malwarepatrol.net/'
MetaDefender MetaDefender 'https://www.opswat.com/developers/threat-intelligence-feed'
Netlab OpenData Netlab 'https://data.netlab.360.com/'
NoThink! NoThink! 'http://www.nothink.org'
NormShield NormShield 'https://services.normshield.com'
NovaSense NovaSense 'https://novasense-threats.com'
Obstracts Obstracts 'https://www.obstracts.com/'
OpenPhish OpenPhish 'https://openphish.com/phishing_feeds.html'
0xSI_f33d 0xSI_f33d 'https://feed.seguranca-informatica.pt/index.php'
PhishTank PhishTank 'https://www.phishtank.com/developer_info.php'
PickupSTIX PickupSTIX 'https://www.celerium.com/pickupstix'
REScure REScure 'https://rescure.fruxlabs.com/'
RST Cloud RST Cloud 'https://rstcloud.net/'
Rutgers IPs Rutgers 'https://report.cs.rutgers.edu/mrtg/drop/dropstat.cgi?start=-86400'
SANS ICS SANS ICS 'https://isc.sans.edu/suspicious_domains.html'
SecurityScorecard SecurityScorecard 'https://github.com/securityscorecard/SSC-Threat-Intel-IoCs'
Stixify Stixify 'https://www.stixify.com/'
signature-base signature-base 'https://github.com/Neo23x0/signature-base'
Spamhaus Spamhaus 'https://www.spamhaus.org/'
Sophos Intelix Sophos 'https://www.sophos.com/intelix'
Spur Spur 'https://spur.us'
SSL Blacklist SSL Blacklist 'https://sslbl.abuse.ch/'
Statvoo Statvoo 'https://statvoo.com/dl/top-1million-sites.csv.zip'
Strongarm Strongarm 'https://strongarm.io'
SIEM Rules SIEM Rules 'https://www.siemrules.com'
Talos Talos 'https://www.talosintelligence.com/'
threatfeeds.io threatfeeds.io 'https://threatfeeds.io'
threatfox threatfox 'https://threatfox.abuse.ch/'
Technical Blogs Technical Blogs 'https://www.threatconnect.com/blog/ingest-technical-blogs-reports/'
Threat Jammer Threat Jammer 'https://threatjammer.com'
ThreatMiner ThreatMiner 'https://www.threatminer.org/'
ThreatPipes ThreatPipes 'https://www.threatpipes.com'
ThreatExchange ThreatExchange 'https://developers.facebook.com/docs/threat-exchange/'
TypeDB CTI TypeDB CTI 'https://github.com/typedb-osi/typedb-cti'
VirusBay VirusBay 'https://beta.virusbay.io/'
threatnote.io threatnote.io 'https://github.com/brianwarehime/threatnote'
XFE XFE 'https://exchange.xforce.ibmcloud.com/'
Yeti Yeti 'https://yeti-platform.github.io/'
1st Dual Stack 1st Dual Stack 'https://IOCFeed.mrlooquer.com/'
Yara-Rules Yara-Rules 'https://github.com/Yara-Rules/rules'
VirusShare VirusShare 'https://virusshare.com/'
CIRCL PDNS CIRCL PDNS 'https://www.circl.lu/services/passive-dns'
InTheWild InTheWild 'https://inthewild.io'
360 Quake 360 Quake 'https://quake.360.net'
Cloudflare Radar Cloudflare Radar 'https://radar.cloudflare.com/traffic'
Validin Validin 'https://app.validin.com'
OSV OSV 'https://osv.dev'
Coalition ESS Coalition ESS 'https://ess.coalitioninc.com'
Certs Certs 'https://certs.io'
CastrickClues CastrickClues 'https://castrickclues.com'
TheWebCo TheWebCo 'https://thewebco.ai'
7.1 GOOGLE DORKS – DOMAINS
site:*.target.com filetype:pdf
site:*.target.com intitle:"dashboard"
site:*.target.com intext:"confidential"
Sections
7. Domain / IP / DNS
open-source intelligence