MyRecon OSINTHow to Investigate a Suspicious Domain: A Step-by-Step Guide
You got a link, an email, or a job offer from a domain you have never heard of. Before you trust it — or click anything — you can learn a surprising amount about it from public data alone, without ever visiting the site. Here is a repeatable workflow.
Step 1: Check the registration age
Start with the domain's WHOIS/RDAP record and look at the creation date. This one field is the most powerful early signal. Scammers register fresh domains constantly, so a site claiming to be an established bank, retailer, or employer that was registered a few days or weeks ago is a serious red flag. Also note the registrar and whether the registration is privacy-protected — legitimate businesses often use corporate registrars, while throwaway scam domains cluster on cheap ones. Our guide on reading a WHOIS record explains each field.
Step 2: Look at the DNS and mail setup
The domain's DNS records reveal how it is actually configured. Does it have proper mail records (MX), or none? Are there SPF and DMARC records, or is the domain wide open to spoofing? A domain built to run a real business tends to have a complete, sensible DNS setup; a domain spun up purely to host a scam page is often bare. Our DNS records guide covers what each type means.
Step 3: Find out where it is hosted
Resolve the domain to its IP address and look up that IP's geolocation and network owner. This tells you which hosting provider and roughly which region serves the site. A "local bank" hosted on a random offshore provider, or infrastructure that does not match the brand's scale, is worth noting. See our guide on IP geolocation and reverse DNS for how to interpret the result.
Investigate, don't visit. The point of this workflow is that you can assess a domain from public records without loading a potentially malicious page. If you must view the site, do it carefully and never enter credentials.
Step 4: Enumerate subdomains
Public Certificate Transparency logs record every TLS certificate issued for a domain, which reveals its subdomains — mail., vpn., staging., login., and so on. Subdomains map out an organisation's real infrastructure and can expose services the front page never mentions. MyRecon's domain tool includes subdomain discovery from these logs.
Step 5: Watch for look-alike tricks
Many malicious domains are designed to be mistaken for a real one. Check carefully for:
- Typosquats — amaz0n.com, micros0ft.com.
- Added words — secure-paypal-login.com.
- Wrong suffix — a real brand's name on an unusual top-level domain.
- Subdomain deception — paypal.com.account-verify.net, where the real domain is the last two labels.
Step 6: Put the signals together
No single fact convicts a domain, but the pattern usually does. A domain that is days old, has no proper mail or anti-spoofing records, is hosted somewhere that does not match its claims, and mimics a known brand is almost certainly not to be trusted. A domain with years of history, a complete DNS setup, and matching infrastructure is far more likely to be genuine. Record what you find with its sources so your judgement is defensible.
Do it in one place
You can run the whole workflow — registration, DNS, hosting, and subdomains — from the MyRecon domain tool, and pivot from one finding to the next (a resolved IP, a nameserver, a discovered subdomain) with a click. Combine it with the other guides to sharpen your read on any domain you are unsure about.