# OSINT on your own company: what is public, and the tools to find it Published: 2026-02-06 · Last reviewed: 2026-10-24 · By HackerGPT Team Canonical: https://hackergpt.org/blog/intelligence-gathering/ > Run OSINT on your own domain before someone else does: which public sources to check, which tools a beginner should learn first, and what one real pass on hackergpt.app turned up. **TL;DR:** To find out what is public about your company, run OSINT on yourself: look up your domain's registration (RDAP), the DNS records you publish, the certificate transparency logs that list every hostname you ever got a TLS certificate for, what search engines indexed, and whether addresses on your domain appear in known breaches. Every one of these is a free public source, and together they show roughly the picture an attacker builds before sending a single request. This page is for the owner of a small site or SaaS, and for anyone starting to learn OSINT who wants a legal, useful first target: their own. It walks through the sources in the order we use them, shows the real output of one pass on `hackergpt.app`, our own domain, and lists the HackerGPT tools that do each step. Run every command here only against domains you own or have written permission to investigate. ## What is OSINT, and why run it on yourself? OSINT, open-source intelligence, is information collected from publicly available sources and analysed to answer a question. In security it is the first phase of reconnaissance: [MITRE ATT&CK's Reconnaissance tactic](https://attack.mitre.org/tactics/TA0043/) describes adversaries gathering victim identity, network and organisation information from open sources before an attack, and the [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/README) opens a web test with the same information-gathering phase. Doing it to yourself is the defensive version of the same work. A forgotten staging subdomain, a verification token that names a tool you use, an old PDF with internal paths in its metadata: each is cheap for anyone to find and cheap for you to fix once you know about it. The [OSINT glossary entry](https://hackergpt.org/learn/osint/) has a shorter definition if you only need that. Scope matters. This page is about your own domain and your own organisation. Looking up private individuals is a different activity with its own legal and ethical limits, and it is not what we teach here. ## How do I find out what is public about my company? Start from your domain and query five kinds of public source, then turn what you find into an inventory of things to remove, rotate or keep. The diagram below is the workflow we use, with what each step showed for `hackergpt.app` on 24 October 2026. ![OSINT workflow on your own domain: five public sources and what each showed for hackergpt.app](https://hackergpt.org/blog/intelligence-gathering/osint-workflow.webp) *One pass over five public sources. The green paths are the ones run for this article; the grey ones are what to look for on your own domain.* The commands below are the ones we ran, and the output is what came back, trimmed only where noted. Replace `hackergpt.app` with your own domain. ### Registration: RDAP ```bash curl -sL https://rdap.org/domain/hackergpt.app \ | jq '{events: [.events[] | {eventAction, eventDate}], status}' ``` ```json { "events": [ { "eventAction": "registration", "eventDate": "2024-10-03T19:21:05.375Z" }, { "eventAction": "expiration", "eventDate": "2027-10-03T19:21:05.375Z" }, { "eventAction": "last update of RDAP database", "eventDate": "2026-10-24T22:17:51.408Z" }, { "eventAction": "last changed", "eventDate": "2026-10-04T16:41:08.888Z" } ], "status": [ "auto renew period", "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ] } ``` What to read in it: the expiry date (a lapsed domain can be re-registered by someone else), the registrar, and the lock statuses. `client transfer prohibited` means the registrar will refuse a transfer request until the lock is lifted. The registry's answer named only the registrar, GoDaddy, and no registrant contact at all; where registrant data is published, it comes from the registrar's own RDAP service. ### DNS records ```bash dig +short NS hackergpt.app dig +short MX hackergpt.app dig +short TXT hackergpt.app ``` ```text ns-1842.awsdns-38.co.uk. ns-726.awsdns-26.net. ns-1048.awsdns-03.org. ns-113.awsdns-14.com. 50 mx3.zoho.com. 10 mx.zoho.com. 20 mx2.zoho.com. "v=spf1 include:zohomail.com ~all" "google-site-verification=nmxN8feqXtsUor6zo5rnXf7vzD3vzO705Xk6y0kP2FU" ``` Three lines tell a stranger who hosts our DNS (Amazon Route 53), who handles our mail (Zoho) and that we use Google Search Console. None of that is a secret, and none of it is a vulnerability. It is exactly the kind of context a phishing email is built from, though, and on your own domain TXT records often name more: every SaaS product that asked you to prove domain ownership left one behind. ### Certificate transparency logs Every publicly trusted TLS certificate is logged in append-only [Certificate Transparency](https://www.rfc-editor.org/rfc/rfc6962) logs, and [crt.sh](https://crt.sh/) lets you search them. A hostname that ever had a certificate stays listed after the host is gone. ```bash curl -s "https://crt.sh/?q=%25.hackergpt.app&output=json" \ | jq -r '.[].name_value' | sort -u ``` ```text *.hackergpt.app ctf.hackergpt.app cybergym.hackergpt.app hackergpt.app juice-shop.hackergpt.app pay.hackergpt.app www.hackergpt.app www.pay.hackergpt.app ``` Then check which of those names still resolve: ```bash for h in cybergym pay www.pay; do echo "$h: $(dig +short A $h.hackergpt.app)" done ``` ```text cybergym: 34.231.169.117 pay: www.pay: ``` This was the most useful step. `cybergym` is our public practice target and is meant to be there. `pay` and `www.pay` had certificates issued in October 2024 and now return `NXDOMAIN`. A name in the logs with no DNS record is harmless. The case to look for on your own domain is the opposite one: a DNS record that still points at a cloud resource you have deleted. That dangling record is what makes [subdomain takeover](https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover) possible, and the certificate log is the quickest list of names to check. ### Search engines and breach data Two sources we did not include output for, because what they return is specific to your organisation: - **Search engines.** Queries like `site:your-app.example filetype:pdf` or `site:your-app.example inurl:staging` show what was indexed that you never meant to publish. [OWASP WSTG-INFO-01](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/01-Conduct_Search_Engine_Discovery_Reconnaissance_for_Information_Leakage) lists the operators and what to look for. - **Breach data.** [Have I Been Pwned's domain search](https://haveibeenpwned.com/DomainSearch) lists addresses on your domain that appear in breaches it has loaded, and it only does so after you prove you control the domain. That requirement is the right shape for this work: you see your own exposure, not someone else's. ## Domain Intelligence Domain intelligence is the registration and DNS layer above. One change since this page was first written: as of 28 January 2025, [ICANN no longer requires gTLD registries and registrars to run WHOIS](https://www.icann.org/rdap), only RDAP, the JSON-over-HTTPS protocol defined in [RFC 9083](https://www.rfc-editor.org/rfc/rfc9083). Classic `whois` still answers for many domains, but RDAP is the source to rely on for gTLDs, and [ICANN's lookup tool](https://lookup.icann.org/) queries it from a browser. In HackerGPT, the `whois` tool returns WHOIS or RDAP data for a domain: registrar, creation and expiry dates, name servers, and whatever contact data is not redacted. A prompt on your own domain looks like: ```text Find domain registration details for your-app.example ``` ## Subdomain Discovery Subdomain discovery lists the hostnames under your domain, which is where forgotten staging, admin and marketing hosts tend to sit. Certificate logs are one source; passive tools such as [subfinder](https://github.com/projectdiscovery/subfinder) query many such sources at once without sending traffic to your hosts. HackerGPT runs `subfinder` for you: ```text Find subdomains for your-app.example ``` For each name it returns, ask three questions: does it still resolve, do you still use it, and does whatever it points to still belong to you. [Map your web app's attack surface](https://hackergpt.org/blog/map-web-app-attack-surface/) is the next step once you know which hosts are live. ## IP & Geolocation Intelligence Resolving a domain to its IP and geolocating it tells you where a host runs and who the provider is. On your own infrastructure that is mostly a check that things are where you think they are: the right cloud region for data-residency commitments, no host left at an old provider. GeoIP data usually resolves to a provider's data centre rather than a building, so treat the location as approximate. ```text What is the IP address of your-app.example? Find geo location of your-app.example ``` ## Dark Web Intelligence Dark web searches look for mentions of your domain, brand or leaked data on Tor sites and in the indexes that cover them. It is the one step in this list with real operational risk, so a few notes from practice: - **Do not connect to Tor from a corporate network on a whim.** It can trip your own intrusion detection, and visiting a hostile `.onion` page exposes your browser to whoever runs it. HackerGPT's `analyze_onion_links` tool fetches and summarises a page through its own Tor proxy, so you do not open it yourself. - **Mirrors are volatile.** A result that was there yesterday may be gone today. Record the URL, the time and what you saw when you see it. - **Look, do not acquire.** Confirming that your data is listed is research; downloading or buying a leaked dataset is a different act, with legal consequences in many jurisdictions. Stop at confirmation and move to rotation. ```text Search Dark Web for your-company ``` `run_darkdump` returns each result's URL and title, a content description and metadata, extracted email addresses, and a sentiment score of the page text. ## Web Fingerprinting Fingerprinting identifies the server, framework and versions a web application runs, which is the point where OSINT stops being passive: it sends requests to the host. Keep it to your own app or CyberGym, and see the [scanning and reconnaissance tool reference](https://hackergpt.org/blog/scanning-reconnaissance-tool/) for the active steps that follow. ```text Check cybergym.hackergpt.app ``` ## Which OSINT tools should a beginner learn first? Learn the free tools behind the first three sources before anything else: `dig` for DNS, an RDAP lookup for registration, and crt.sh for certificate logs. They need no account, they explain what every larger OSINT platform is aggregating, and their output is short enough to read line by line. After those, in this order: 1. **Search engine operators** (`site:`, `filetype:`, `inurl:`), because they find documents and pages the other tools cannot. 2. **A passive subdomain aggregator** such as subfinder, once you understand what a single certificate log returns. 3. **Breach-data lookups** for your own domain. 4. **Dark web search**, last, and through a tool that keeps you off Tor directly. If you want to practise on a target built for it, [CyberGym](https://cybergym.hackergpt.app) is a legal, deliberately vulnerable app, and [practising hacking legally](https://hackergpt.org/blog/practice-hacking-legally/) covers others. OSINT also has its own CTF category; [CTF for beginners](https://hackergpt.org/blog/ctf-for-beginners-web-challenges/) is a good place to see how challenges are structured. ## Common Workflows The order we run the HackerGPT tools for a first pass on our own domain: 1. `Find domain registration details for your-app.example` 2. `Find subdomains for your-app.example` 3. `What is the IP address of ?` and `Find geo location of …` 4. `Search Dark Web for your-company` 5. `Check your-app.example` (fingerprinting, the first active step) The [OSINT feature](https://hackergpt.org/features/) starts from a domain name or a token and runs these lookups from one conversation; you can [try it on your own domain](https://hackergpt.app). What it returns are findings to verify, not a verdict on your exposure: public sources are incomplete and sometimes wrong. ## Best Practices - **Investigate only what you own or are permitted to.** That includes subdomains: a name under your domain can point at a host someone else controls. - **Start passive.** Registration, DNS, certificate logs and search engines send nothing to your hosts. - **Confirm in a second source** before acting on a finding. - **Rotate, do not just delete.** A secret that was public is compromised even after the file is gone; archives and caches keep copies. - **Repeat it.** New certificates and new DNS records appear every time someone ships something, so a quarterly pass catches what a one-off pass cannot. ## Quick Reference | Tool | Purpose | Example prompt | | --- | --- | --- | | `whois` | Domain registration (WHOIS or RDAP) | `Find domain registration details for your-app.example` | | `subfinder` | Passive subdomain enumeration | `Find subdomains for your-app.example` | | `get_domain_ip` | Domain to IP resolution | `What is the IP address of your-app.example?` | | `get_ip_geolocation` | IP geolocation | `Find geo location of your-app.example` | | `run_darkdump` | Dark web search | `Search Dark Web for your-company` | | `analyze_onion_links` | Fetch and summarise an onion page via Tor | `Analyze http://your-mention.onion` | | `web_fingerprint` | Web app fingerprinting (active) | `Check cybergym.hackergpt.app` | ## Key takeaways - Run crt.sh on your domain today and check every name it lists against your DNS; dangling records are the finding worth the most. - Read your TXT records as a stranger would, and remove verification tokens for services you no longer use. - Use RDAP rather than WHOIS for gTLD registration data, and watch your expiry date. - Check breach data only through services that make you prove you own the domain, and rotate what you find rather than deleting it. - Keep dark web research behind a proxy or tool, and stop at confirming that your data is listed. ## FAQ ### What is OSINT? OSINT, open-source intelligence, is information gathered from publicly available sources such as DNS, certificate logs, search engines and company filings, then analysed to answer a question. In security it is the first phase of reconnaissance, done before any request is sent to the target's systems. ### How do I do OSINT on my own company? Start from your domain and check its registration (RDAP), its DNS records, the certificate transparency logs on crt.sh, what search engines have indexed, and breach data for addresses on your domain. List what you find, remove what should not be public, rotate anything that leaked, and repeat the pass every few months. ### Which OSINT tools should a beginner learn first? Start with dig, an RDAP lookup and crt.sh. They are free, need no account, and show the raw data that larger OSINT platforms aggregate. Add search engine operators, a passive subdomain tool such as subfinder, and breach lookups after that. ### Is OSINT legal? Collecting information that is publicly available is generally legal, but what you do with it, and against whom, is not automatically so. Keep OSINT to your own domain and organisation or to targets with written permission, and stop before using anything you find to access a system. ### Can certificate logs show subdomains I deleted? Yes. Certificate transparency logs are append-only, so every hostname that ever received a publicly trusted certificate stays listed after the host is removed. That makes them a good checklist for finding DNS records you forgot to delete. ## Sources - [MITRE ATT&CK: Reconnaissance (TA0043)](https://attack.mitre.org/tactics/TA0043/) - [OWASP Web Security Testing Guide: Information Gathering](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/README) - [OWASP WSTG-INFO-01: Search Engine Discovery Reconnaissance](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/01-Conduct_Search_Engine_Discovery_Reconnaissance_for_Information_Leakage) - [ICANN: Registration Data Access Protocol (RDAP)](https://www.icann.org/rdap) - [RFC 9083: JSON Responses for RDAP](https://www.rfc-editor.org/rfc/rfc9083) - [RFC 6962: Certificate Transparency](https://www.rfc-editor.org/rfc/rfc6962) - [crt.sh certificate search](https://crt.sh/) - [projectdiscovery/subfinder](https://github.com/projectdiscovery/subfinder) - [Have I Been Pwned: Domain search](https://haveibeenpwned.com/DomainSearch) - [Microsoft Learn: Prevent dangling DNS entries and avoid subdomain takeover](https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover)