Skip to content
statance
MenuClose
Log inStart for free ↗
← Free tools

Investigate any domain or IP address

One search shows who registered a domain, how its DNS and email are set up, who hosts it, what subdomains exist and whether it is up right now — from public records, in plain language.

Everything public about a domain, on one page

SectionWhat it shows
Registration (WHOIS / RDAP)Registrar, created, updated and expiry dates, status codes, nameservers and DNSSEC. For registries without RDAP, such as .nz, it falls back to classic WHOIS on port 43.
DNS recordsA, AAAA, CNAME, MX, NS, TXT, SOA and CAA records.
Email securitySPF, DMARC, MTA-STS and common DKIM selectors.
IP address detailsOwner, range, ASN, country, abuse contact and reverse DNS, for IPv4 and IPv6.
Their setupWhat the public records reveal: email provider from MX (e.g. Google Workspace, Microsoft 365, Proofpoint), sending services from SPF (e.g. SendGrid, Mailchimp, Salesforce), DNS host from NS, hosting or CDN from the ASN and headers (e.g. AWS, Cloudflare, DigitalOcean), website platform (e.g. WordPress, Shopify) and services verified via TXT records (e.g. Google, Microsoft, Apple, Atlassian).
What we foundPlain-language checks: domain expiry, transfer lock, DNSSEC, HSTS, CSP and frame protection, SPF and DMARC — including DMARC set to p=none.
SubdomainsDiscovered from certificate transparency logs. Check any subdomain with the “?” button, or “Check the first 50” to see which resolve, their HTTPS status and response time, and dangling CNAMEs flagged as subdomain-takeover risks.
Hostnames on an IPNames seen on the same address, from Statance’s own observations and HackerTarget’s reverse-IP index. Shared CDNs and hosting mean these may be unrelated.
Is it down for everyone?A live check from 6 regions, so you can tell a local problem from a real outage.
Security headers gradeAn A–F grade for the site’s HTTP security headers.

Sections load progressively and results are cached for 6 hours. See the Investigate docs for what each section means and where the data comes from.

Monitor anything you find, in one click

Every useful element on an Investigate page has a monitor button. If you’re not logged in, you sign up and land on the monitor form already filled in.

  • Website uptime: HTTP checks on the site or any discovered subdomain.
  • SSL certificate expiry: Warns before the certificate expires.
  • Domain expiry: Checks RDAP/WHOIS every 6 hours and alerts a set number of days before the registration expires (30 by default).
  • DNS record changes: Alerts if an A, MX, NS, TXT or CNAME record stops matching what you expect.
  • Mail server reachability: TCP port 25 checks on each MX host.
  • DMARC / SPF presence: Alerts if the record disappears.
  • IP port checks: TCP checks on an IP address and port.
  • Subdomain uptime: HTTP checks for subdomains discovered in certificate logs.

Monitor everything creates the useful set for a domain in one click — uptime, SSL, domain expiry, DNS, nameservers, mail and DMARC — within your plan’s monitor limit.

Built for people and agents

Use it in the browser, from your own scripts, or let an AI agent run it for you.

curl https://api.statance.com/v1/investigate/example.com \ -H "Authorization: Bearer YOUR_API_KEY"

AI agents connected to the Statance MCP server can call the investigate tool.

Questions

Is Investigate free?

Yes. Anyone can look up a domain or IP address at statance.com/tools/investigate without an account. Creating monitors from the results needs a Statance account; the free plan works.

Where does the information come from?

Public sources: RDAP and classic WHOIS for registration data, DNS, certificate transparency logs (via crt.name and crt.sh) for subdomains and recent certificates, IP registry data for owners and ranges, HackerTarget’s reverse-IP index plus Statance’s own observations for hostnames on an IP, and live HTTP requests from Statance’s six check regions.

How fresh are the results?

Results are cached for 6 hours. The page loads section by section, so the quick answers appear first.

Can I use it from code or an AI agent?

Yes. The same report is available from the REST API as GET /v1/investigate/:q and to AI agents as the investigate tool on the Statance MCP server.

Does a hostname on the same IP mean the sites are related?

Not necessarily. Many sites share IP addresses behind CDNs and shared hosting, so hostnames seen on an IP can belong to unrelated owners.

Related: Is it down for everyone? · Domain expiry monitoring · Subdomain takeover checks