Confirm ownership
Use an internal asset register, DNS admin access or written authorization before checking the domain.
Authorized OSINT field guide · 2026-06-22
Domain exposure checklist
Use this when the target domain is yours or explicitly in scope.
Run passive lookup
Start with Censys, Shodan, certificates, DNS history and public search results.
Scan narrowly
If active collection is allowed, scan one domain with conservative SpiderFoot modules.
Triage by exposure
Prioritize public admin panels, forgotten hosts, weak service banners and unexpected certificates.