OSINT workspace
A domain's registration, DNS settings and email authentication are public technical data. These tools read them from the source, show the raw response and add our reading separately.
The research file lives in this tab's session memory only.
Reads the public registration record of a domain: registrar, dates, status codes, name servers and DNSSEC. Holder details are not shown.
Sent: The domain name.
Goes to: rdap.org. rdap.org forwards the request to the registry that runs the extension. Both can see the name and your IP address; ZEKASTRA servers see nothing.
Open the source yourself
Asks a public resolver for A, AAAA, MX, NS, TXT, SOA and CAA records, or for a single type including CNAME, DS and DNSKEY. Shows the answering resolver, the status, the DNSSEC flag and the TTLs.
Sent: The domain name and the record type, as DNS over HTTPS queries.
Goes to: cloudflare-dns.com, dns.google. Cloudflare (1.1.1.1) is asked first; Google Public DNS is used only if Cloudflare gives no usable answer. The resolver sees the name and your IP address.
Reads the SPF, DMARC, MTA-STS and BIMI records of a domain and, if you give a selector, its DKIM key. Each finding is marked as fine, to check or a problem, with the reason.
Sent: The domain name, with the prefixes _dmarc, _mta-sts, default._bimi and, if given, selector._domainkey.
Goes to: cloudflare-dns.com, dns.google. The request goes from your browser straight to the source; ZEKASTRA servers do not see it. The source sees the query and your IP address.
Lists the names that appear in publicly logged TLS certificates for a domain, with the first and last dates. A name in a certificate shows that it was named there, not that a site is live.
Sent: The domain name.
Goes to: crt.sh. The request goes from your browser straight to the source; ZEKASTRA servers do not see it. The source sees the query and your IP address.
Open the source yourself
crt.sh is run by a certificate authority and has no published usage terms. It can be slow or refuse requests; the real error is shown if it does.
Asks the Internet Archive for the first, the latest and the closest capture of an address.
Sent: The link or domain you enter.
Goes to: archive.org, web.archive.org. The request goes from your browser straight to the source; ZEKASTRA servers do not see it. The source sees the query and your IP address.
Open the source yourself
Generates up to 60 look-alike names (missing, doubled or swapped letters, neighbouring keys, similar characters, Turkish letters, hyphens, other extensions). Generating sends nothing; a separate button checks which of them answer in DNS.
Sent: Nothing when the list is generated. If you press the check button, up to 60 candidate names are sent as NS and A queries.
Goes to: cloudflare-dns.com, dns.google. The request goes from your browser straight to the source; ZEKASTRA servers do not see it. The source sees the query and your IP address.
Takes a link apart without opening it: host, registrable domain, scripts in the name, credentials in front of the host, shorteners, nested links and encoded parameters. Shows the link in a safe (defanged) or plain form.
Sent: nothing. The link is analysed as text in your browser and is never opened.
Builds links to services that you open yourself: VirusTotal, urlscan.io, URLhaus, Shodan, Censys, bgp.he.net, crt.sh and the Wayback Machine.
Sent: nothing. Only addresses are built. The sites see the name when you open them.