## Domain & Infrastructure OSINT\n\n### WHOIS Lookups\n\nWHOIS reveals domain registration information:\n- Registrant name/organization\n- Registration/expiration dates\n- Name servers\n- Registrar information\n\n**Tools**: `whois`, DomainTools, ViewDNS.info\n\n### DNS Reconnaissance\n\n```bash\n# Find subdomains\ndig axfr @ns1.target.com target.com\n\n# Get all DNS records\ndig target.com ANY\n\n# Reverse DNS lookup\ndig -x 192.168.1.1\n```\n\n**Tools**: DNSDumpster, SecurityTrails, Subfinder\n\n### Certificate Transparency\n\nSSL certificates are logged publicly. Search for subdomains:\n- crt.sh\n- Censys\n- Google CT logs\n\n### Shodan & Censys\n\nSearch engines for internet-connected devices:\n\n```\n# Shodan queries\norg:"Target Company"\nssl.cert.subject.CN:"target.com"\nproduct:"Apache" country:"US"\n```\n\n### Combining Intelligence\n\n1. Start with domain WHOIS\n2. Find related domains (same registrant)\n3. Enumerate subdomains via CT logs\n4. Scan infrastructure with Shodan\n5. Map the complete attack surface