For security teams, researchers, operators, and agent builders
Use this workflow for incident context, asset research, vendor review, and public infrastructure mapping.
Solution for infrastructure research
Follow a domain into the public infrastructure around it
Start with one domain or host, collect current resolution evidence, and pivot through observed relationships that matter to the investigation.
A bounded, evidence-linked infrastructure map
Connect observed domains, hosts, DNS records, IPs, certificates, technologies, reputation, and registration context.
Infrastructure relationships change and rarely appear in one source
Shared hosting, cached DNS, incomplete subdomain observations, redacted records, and changing certificates can create misleading shortcuts.
Observed relationships are not ownership or complete attribution
Shared services, changing records, incomplete observations, and public-data gaps prevent universal infrastructure mapping.
Workflow
Connect observed domains, hosts, DNS records, IPs, certificates, technologies, reputation, and registration context.
Establish the domain and DNS snapshot
Use Domain Profile and DNS Lookup to capture current registration, resolution, and service evidence.
Pivot to observed hosts and networks
Use Subdomains and IP Intelligence for public names and addresses actually observed in the workflow.
Add trust and website context
Inspect certificates, reputation, redirects, technologies, and public page evidence for the entities that remain relevant.
Investigate infrastructure behind a reported domain
Start from the domain, gather current DNS and observed subdomains, enrich related IPs, then inspect trust and website evidence.
Example Request
curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/dns?domain=example.com&type=A"Example Response
{
"domain": "example.com",
"record_type": "A",
"records": [{ "type": "A", "name": "example.com", "data": "93.184.216.34", "ttl": 300 }],
"status": "success"
}Products in this workflow
Connect observed domains, hosts, DNS records, IPs, certificates, technologies, reputation, and registration context.
DNS Lookup
Perform DNS lookups for any record type.
Choose this when: Perform DNS lookups for any record type.
- Inputs
- Domain, DNS name
- Outcomes
- Discover, Enrich, Monitor
- Credits
- 1-3
SynchronousRESTMCPSDKInteractive tool
Subdomain Finder
Discover subdomains for a domain using various enumeration techniques.
Choose this when: Discover subdomains for a domain using various enumeration techniques.
- Inputs
- Domain, DNS name
- Outcomes
- Discover, Assess
- Credits
- 4-5
SynchronousBulkRESTMCPSDKInteractive tool
IP Geolocation
Get geolocation data for an IP address including country, city, and ISP.
Choose this when: Get geolocation data for an IP address including country, city, and ISP.
- Inputs
- IP address, Domain
- Outcomes
- Enrich, Assess
- Credits
- 1
SynchronousRESTMCPSDKInteractive tool
SSL Certificates
Get SSL certificate information including issuer, validity, and security grade.
Choose this when: Get SSL certificate information including issuer, validity, and security grade.
- Inputs
- Domain, Certificate
- Outcomes
- Discover, Verify, Assess
- Credits
- 1-10
SynchronousBulkRESTMCPSDKInteractive tool
WHOIS Lookup
Get WHOIS information for a domain including registrar, dates, and status.
Choose this when: Get WHOIS information for a domain including registrar, dates, and status.
- Inputs
- Domain
- Outcomes
- Enrich, Assess
- Credits
- 3
SynchronousBulkRESTMCPSDKInteractive tool
Choose this workflow when
Choose this when
You need to follow a known public domain or host into related DNS, network, trust, and website evidence.
Not for
Do not use it as complete asset discovery, private-network mapping, ownership proof, or definitive attribution.
Related product suites
A bounded, evidence-linked infrastructure map
Start with one domain or host, collect current resolution evidence, and pivot through observed relationships that matter to the investigation.