Staying Under the Radar

Passive reconnaissance means gathering information without directly touching the target infrastructure.

Core sources

• **WHOIS and registrar data** for ownership clues.
• **DNS records** for service structure and subdomains.
• **Certificate transparency logs** for hostnames somebody forgot were visible.
• **Web archives** for historical content and naming conventions.

Why passive first

• It is quieter.
• It establishes baseline context before active validation.
• It often reveals enough to narrow later steps dramatically.

The best first move is often "read what is already public" rather than "immediately make logs somewhere light up."