Prerequisites
Tutorial 104: Dark web legal and ethical boundaries for investigators.
01
A website's infrastructure tells you who built it, who controls it and when both changed
Registrar records, DNS history and TLS certificates are passive artefacts that accumulate over a domain's life. They are not curated for investigators, which means they preserve operational detail that a subject cannot easily scrub: previous owners, linked infrastructure, hosting pivots and technology fingerprints.
Website infrastructure analysis is the process of querying open registrar, DNS and certificate-transparency data to establish who registered a domain, who hosts it, what technology stack it runs, and how those facts have changed over time. Every layer queried in this tutorial is openly published as a condition of how the internet's naming and certificate systems operate, and the output of a single domain query can seed a network of associated infrastructure that would take days to map manually.
In the field
The Tow Center for Digital Journalism's December 2019 investigation, published as "Hundreds of 'pink slime' local news outlets are distributing algorithmic stories and conservative talking points," used WHOIS, shared hosting IP addresses and shared analytics tracking IDs to link more than 450 superficially independent domains to a small number of corporate entities. Sites carried no shared bylines and used distinct visual templates, but were connected through common registrant patterns, co-located IP addresses and repeated analytics account IDs.
- WHOIS registrant pattern analysis. Domain registration records across the network revealed repeated registrant and organisational patterns linking sites to a small number of corporate entities.
- IP co-location. Reverse IP lookups tied clusters of domains to the same hosting server, establishing shared infrastructure at scale.
- Analytics fingerprint. Shared Google Analytics and other tracking IDs across sites with different visual templates confirmed common administration despite the absence of shared bylines.
Tow Center for Digital Journalism, Columbia Journalism School · CJR · 18 December 2019
Learning outcomes
By the end of this tutorial you will be able to:
Query WHOIS and historical DNS records to establish registrant identity and hosting history for any domain
Read a TLS certificate chain to extract subject-alternative names and organisation fields that link domains to a common operator
Use BuiltWith to fingerprint the technology stack of a site and identify shared analytics or tag-manager IDs across multiple domains
Pivot from a single domain to a network of associated infrastructure using IP history and nameserver data
Document each query with sufficient chain-of-custody detail to support a defensible investigative record
The rest of this tutorial is for Signal subscribers.
What remains: the decision framework, the tool configuration, the failure modes, and the evidentiary standard required to use the finding defensibly. Signal is €90 a year, or €9 a month. Students, €49 a year.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every prompt and field report
- Shadow Analysis, every forensic dossier
