TREN
Back to workflows

Domain workflow

Is this website or domain suspicious?

A safe passive workflow for reading a domain, URL, DNS trace, and archive history.

Passive and safe research workflow

When to use it

You received a link. You want to know what the domain is, what public history exists, and how to write a careful note without overclaiming.

What you get

Domain profile, timeline note, visible signals, sources, and open questions.

Safety boundary

This workflow is not for exploitation, probing, or unauthorized scanning. It reads public records, records dates and uncertainty, and avoids turning signals into final claims.

Simple order

Work through the steps in order.

  1. Clean the URL

    Separate protocol, root domain, subdomain, path, and tracking parameters.

    Check: Root domain and full URL are written separately.

  2. Read DNS and registration context

    Check RDAP/WHOIS, nameservers, mail records, and visible DNS records.

    Check: At least two passive sources are compared.

  3. Check certificates and archives

    Use Certificate Transparency and web archives for a short timeline.

    Check: Archive time is not treated as publish time.

  4. Write a limited finding

    State visible traces, confidence, and what remains unknown.

    Check: No ownership or malware claim is overstated.

Real tools to open

Report language

Public records show visible domain and infrastructure traces; ownership, intent, and current risk still need separate confirmation.

Move to evidence notes

Sources

Start with these sources.

Open resource archive
  • AlienVault OTX logo

    AlienVault OTX

    Threat intelligence

    Use for IOC context, reputation checks, and defensive security notes.

    Open source
  • BuiltWith logo

    BuiltWith

    Web history and archives

    Use to compare old pages, deleted claims, and archived versions.

    Open source
  • Censys Search logo

    Censys Search

    Certificate transparency

    Use this source as one part of a wider verification workflow.

    Open source
  • Cert Spotter logo

    Cert Spotter

    Certificate transparency

    Use this source as one part of a wider verification workflow.

    Open source
  • CertStream logo

    CertStream

    Certificate transparency

    Use this source as one part of a wider verification workflow.

    Open source
  • Cloudflare Merkle Town logo

    Cloudflare Merkle Town

    Certificate transparency

    Use this source as one part of a wider verification workflow.

    Open source