Infrastructure
What is Passive DNS?
A historical database of DNS answers seen over time, showing which IPs a domain pointed to and which domains shared an IP.
Passive DNS is a historical record of DNS resolutions, collected by sensors that observe real DNS traffic. It shows which IP addresses a domain has pointed to over time, and which other domains have resolved to the same IP.
It is one of the most powerful pivoting tools in infrastructure analysis. A single malicious domain can lead to the server behind it, and from there to every other domain the operator hosted on that server.