A domain migrates behind Cloudflare and the operator believes the origin IP is protected. It is not. Every resolver that answered queries before that migration logged the response, and those records are queryable today in databases that have been accumulating history since 2010.
Passive DNS is the permanent historical archive of every IP a domain has ever resolved to. Attackers use these records to find origin servers hidden behind CDNs, track infrastructure movements over months, and expand a single IOC into a complete campaign map.
What Passive DNS Records That Active DNS Does Not Show
Passive DNS captures A, AAAA, NS, MX, and CNAME records with first-seen and last-seen timestamps — everything that was ever authoritative for that domain, regardless of what it points to today. Farsight's DNSDB stores over 300 billion records dating back to July 2010, ingesting up to 200,000 DNS observations per second and 2TB of data daily. SecurityTrails has indexed 3.5 billion hostnames with first_seen and last_seen timestamps on every entry.
The practical difference between active and passive DNS is not technical — it is temporal. Active DNS queries the authoritative server now and returns the current state. Passive DNS aggregates responses from distributed sensors over years, without making any connection to the target. This lets you reconstruct an adversary's infrastructure history without triggering any detection system.
Every DNS change leaves the previous record intact in passive databases. Migrating to a CDN does not erase the prior A record, switching hosting does not eliminate old NS records, and domain expiration does not remove entries that pointed to the origin server. The result is a permanent inventory of infrastructure decisions the operator assumed were temporary.
IP Pivot: From One IOC to an Entire Campaign
The Coyote Banking Trojan demonstrated the value of the IP pivot in 2024 with precision documented by Validin. The C2 domain cloridatosys[.]com resolved to IP 20.201.119[.]204, with a first_seen date in December 2023. A passive DNS query for all domains that resolved to that IP during the same period returned 48 domains: 18 matched exactly the domains from BlackBerry's report, and 30 were previously unknown in any public threat feed.
The Gamaredon/ACTINIUM case scales the same mechanism to APT level. Microsoft's February 2022 report listed 124 malicious domains belonging to the group, which was targeting Ukrainian organizations. Passive DNS analysis by Embee Research showed that 49 of the 124 domains resolved to IP 139.180.174[.]234 around July 27, 2022. Filtering .ru domains that pointed to that IP at that timestamp, the researcher found 122 previously unreported domains, including coffiti[.]ru, torfasta[.]ru, and vilitord[.]ru, all exhibiting the same subdomain generation pattern with random words. The 124-domain blocklist became 246 in a few hours.
The mechanism is straightforward: initial IOC, historical IP, all domains that shared that IP, pattern matching. Campaign infrastructure reuses hosting because changing IPs has real operational cost, and that behavior is the signal passive DNS makes persistently visible.
CDN Bypass: How Historical Records Expose the Origin Server
Any domain that existed before enabling a CDN was indexed with its origin IP. A 2024 academic analysis of the Tranco Top 1M identified 4,766 CDN-protected domains with DNS vulnerabilities; 727 of them, 15.25% of the total, exposed the origin server IP through residual records or post-CDN-termination resolution.
The residual vulnerability occurs when a client migrates away from a CDN or cancels the contract: the old A record, pointing directly to the origin server, persists in passive DNS databases regardless of the current configuration. The practical flow: SecurityTrails returns historical A records for the domain, the pre-CDN IP is validated in Shodan or Censys confirming that port 80/443 still responds, and the request goes directly to the origin server, bypassing firewall, WAF, and DDoS protection.
Staging subdomains amplify the problem. Subdomains like staging.target.com, dev.target.com, or origin.target.com frequently point directly to the server without CDN protection, appear in passive DNS even when the primary domain is protected, and continue responding because administrators rarely include them in the hardening scope.
Lazarus and the Email Address That Connected 27 VPN Servers
The $1.4B ByBit theft in February 2025 was prepared in advance, with the timeline documented in passive DNS. The domain bybit-assessment[.]com was registered on February 20, 2025 at 22:21:57 UTC, hours before the attack executed. The A record pointed to IP 91.222.173[.]30, which from February 21 onward hosted multiple malicious domains identified by Silent Push in its Lazarus Group infrastructure analysis.
Pivoting on that IP address revealed a cluster of cryptocurrency scam and fake job listing infrastructure: blockchainjobhub[.]com, jobinterview360[.]com, nvidia-release[.]org. The registrant email trevorgreer9312@gmail[.]com was tied to a Lazarus operational persona documented in prior campaigns. That single correlation point connected apparently unrelated domains spread across months of operation.
Exposed infrastructure logs revealed 27 unique Astrill VPN IPs, confirming the OPSEC pattern consistent with DPRK operators. Passive DNS provided the full temporal correlation: domain created hours before the attack, sharing hosting with prior campaign infrastructure, linked by registrant email to a known persona from the group's previous operations.
Tools: Free, Commercial, and When to Use Each
No passive DNS provider has complete sensor coverage. The choice depends on the historical depth required, the analysis context (malware vs. APT), and the need for API access in automated pipelines.
DNSDB (Farsight/DomainTools): over 300 billion records since July 2010, API-first, precise first_seen/last_seen timestamps with observation counts. Best for APT infrastructure analysis requiring years of historical reach. SecurityTrails: 3.5 billion hostnames indexed, free tier available, certificate transparency integration. Best for CDN bypass and quick lookups. VirusTotal passive DNS: direct correlation with indexed malware samples. Best when analysis starts from a malware sample rather than a domain. Microsoft Defender TI (formerly PassiveTotal/RiskIQ): 400 million records per day, SSL certificate correlation, integrated into the Microsoft stack. Best for SOC analysts in the Microsoft ecosystem. Validin: free tier with malware infrastructure pivot capability; when a CDN blocks IP pivoting, the HTML title tag pivot technique is an effective alternative even against Cloudflare-protected C2s.
Reverse Monitoring: Getting Alerts When Your IP Appears in a New Domain
Passive DNS works in both directions. The logic an attacker uses to map a target's infrastructure can be inverted to detect when new domains point to your organization's IPs, turning the same technique into a defensive tool.
Passive DNS APIs have a lag of 5 to 30 minutes, compared to seconds for Certstream on TLS certificates. Certstream does not capture domains without HTTPS, which leaves uncertificated attack infrastructure outside the monitoring window. Passive DNS monitoring covers that gap: it detects domains pointing to the organization's IP block regardless of certificates, with minute-level latency that is acceptable for most defensive use cases. intel.mago.team (MAGO team tool) monitors new DNS records pointing to organization IPs and alerts when a newly created domain resolves to the registered IP block.
The abuse pattern is documented: attackers register phishing domains pointing to compromised infrastructure within the victim's IP block before the compromise is detected. Every domain migration, every hosting switch, every CDN contract cancellation leaves a permanent trace in passive DNS. The practitioner who checks historical A records before assuming CDN protection, and who pivots on IPs before treating a domain as isolated, sees the infrastructure the operator believed was hidden.
Top comments (0)