WHOIS and RDAP
Registrar, registration and expiry dates, name servers.
Since the EU data-protection regime took effect in 2018, registrant contact details are redacted by default on most domains. Absence of a name is now the norm, not a signal.
Passive DNS
What a domain resolved to in the past, and what else pointed at an address.
Coverage depends on the vendor’s sensors. A historical resolution proves neither control nor malice at that time.
Certificate Transparency Logs
Publicly trusted certificates as they are issued, including subdomains that never appeared in DNS.
A certificate that existed stays in the log forever. It tells you nothing about whether the host is live now.
Autonomous System Lookup
Which network operator announces a block of addresses.
Says nothing about the tenant. Shared hosting, cloud and resellers sit between the operator and the actor.