<aside> ⚠️ Always think search engines and operators
</aside>
Details about website technologies
Plugins, framework, host providers etc
Free online network tools - traceroute, nslookup, dig, whois lookup, ping - IPv6
Address look up (important for on premise)
Look for record, how own the website (can provide information)
Information about mails
Service scan (Nmap)
Look for certificates
Extra subdomains
Find all domains sharing the IP address
(can be useful for on premise situations)