Investigate
What each section of the free Investigate domain and IP report means, where the data comes from, caching, the API endpoint, the MCP tool and monitoring.
Investigate is a free lookup for any domain or IP address at statance.com/tools/investigate, or directly at statance.com/investigate/<domain-or-ip>. No account is needed. Sections load progressively and results are cached for 6 hours.
Sections
Registration (WHOIS / RDAP)
Registrar, created, updated and expiry dates, status codes (including transfer lock), nameservers and DNSSEC. Data comes from RDAP; for registries without RDAP, such as .nz, Statance falls back to classic WHOIS on port 43.
DNS records
A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records.
Email security
SPF, DMARC, MTA-STS and common DKIM selectors.
IP address
Owner, range, ASN, country, abuse contact and reverse DNS, for IPv4 and IPv6.
Their setup
A summary detected from public records:
- email provider from MX records (e.g. Google Workspace, Microsoft 365, Proofpoint);
- sending services from SPF (e.g. SendGrid, Mailchimp, Salesforce);
- DNS host from NS records;
- hosting or CDN from the ASN and HTTP headers (e.g. AWS, Cloudflare, DigitalOcean);
- website platform (e.g. WordPress, Shopify);
- services verified via TXT records (e.g. Google, Microsoft, Apple, Atlassian).
What we found
Plain-language checks: domain expiry, transfer lock, DNSSEC, HSTS, CSP and frame protection, SPF, DMARC, and DMARC set to p=none.
Subdomains
Names found in certificate transparency logs (via crt.name; recent certificates via crt.sh). Use the ? button to check one, or Check the first 50. Each check shows whether the name resolves, its HTTPS status and response time, and flags dangling CNAMEs — CNAMEs pointing at targets that no longer resolve — as subdomain-takeover risks. Only names that appeared on public certificates are listed.
Hostnames on this IP
Hostnames seen on the same IP address, from Statance’s own observations and HackerTarget’s reverse-IP index. Shared CDNs and hosting put many unrelated sites on one address, so treat these as leads, not proof of common ownership.
Is it down for everyone?
A live HTTP check from 6 regions (US West, US East, Western Europe, Eastern Europe, Asia Pacific, Oceania).
Security headers grade
An A–F grade based on the site’s HTTP security headers.
Monitor from anywhere on the page
Elements on an Investigate page have a monitor button that creates the matching monitor in one click. Logged-out visitors sign up and land on the monitor form already filled in.
| From | Monitor |
|---|---|
| The website | Website uptime (HTTP) |
| The certificate | SSL certificate expiry |
| The registration | Domain expiry — checked every 6 hours, alerts 30 days before expiry by default |
| A / MX / NS / TXT / CNAME records | DNS record change — alerts if the record stops matching |
| MX hosts | Mail server reachability (TCP port 25 on each MX) |
| Email security | DMARC / SPF record presence |
| An IP address | IP port check (TCP) |
| A subdomain | Subdomain uptime |
Monitor everything creates the useful set for a domain — uptime, SSL, domain expiry, DNS, nameservers, mail and DMARC — within your plan’s monitor limit.
API
GET /v1/investigate/:q
curl https://api.statance.com/v1/investigate/example.com \ -H "Authorization: Bearer YOUR_API_KEY"
:q is a domain or an IPv4/IPv6 address.
MCP
AI agents connected to the Statance MCP server can call the investigate tool with a domain or IP address.
Next: Alert rules →