Passive Research and Its Limits

Four passive sources do most of the infrastructure work, and each answers a narrower question than people assume.

Registration records give the registrar, the dates and the name servers. Since the European data-protection regime took effect in 2018, registrant contact details are redacted by default. An absent name is the normal state of the record and tells you nothing about the registrant.

Passive DNS shows what a domain resolved to in the past, and what else pointed at an address. Coverage depends on whose sensors saw it, so absence is weak evidence, and a historical resolution proves neither control nor malice at that time.

Certificate transparency logs record publicly trusted certificates as they are issued, including subdomains that never appeared in DNS. A hit establishes that a name existed and was certified at a moment. Entries never expire out of the log, so a hit says nothing about whether anything answers there now.

Autonomous system lookups tell you which network operator announces a block of addresses. Between the operator and the actor sit hosting resellers, cloud tenancies, and content networks, so the operator is rarely the tenant.

All four are passive, which matters legally as well as operationally: reading public records is not the same act as touching a system. The line between research and intrusion is one you should be able to point at in writing before you go near it.