threat-intel
Passive DNS for Investigators: Tracking Infrastructure Through Time
Info
Summary
Passive DNS (pDNS) is a method of tracking domain resolution history, allowing investigators to reconstruct attacker infrastructure and timelines. The technique relies on historical DNS data collected from various sources and involves a process of identifying clusters of related domains and IPs, filtering out noise, and following the movement of attacker infrastructure. It is a valuable tool for proactively blocking domains and hunting for historical evidence of attacks.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data