What it means
Passive DNS analysis uses historical domain-to-address observations to examine infrastructure changes, relationships, reuse, and timing without directly querying adversary systems.
Why it matters
Historical resolution data can expose clusters and pivots that are no longer visible in current DNS records.
Practical focus
- Start from a validated domain or address
- Compare first-seen, last-seen, and overlap periods
- Corroborate relationships with certificates, hosting, and behavior
- Respect source coverage and retention limitations
Common mistakes
- Assuming shared hosting proves common ownership
- Treating old resolution as current infrastructure
- Ignoring sinkholes and security-research systems
- Pivoting without documenting confidence
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: