Passive recon: your domain's public footprint

The first phase of a serious attack doesn't touch the target. Before sending a single packet, whoever means business gathers everything already public: DNS, certificates, historical records, exposed services. It's called passive reconnaissance, it's undetectable to you, and it almost always reveals more than you'd think. The good news: you can look at your own footprint with the same eyes and shrink it.

What's known without touching you

1. DNS: the map of your infrastructure

DNS records are public by definition. One look says a lot:

• MX → who carries your mail (Google, Microsoft 365, Zoho…).
• TXT / SPF → which services send mail on your behalf: every SPF include: gives away a SaaS you use (marketing, billing, support…).
• NS → your DNS provider; A/AAAA → your IPs (and from there, the hosting).

dig +short MX example.com
dig +short TXT example.com     # look for "v=spf1 …"
dig +short NS example.com

2. Certificate Transparency: the subdomain snitch

Here's the gem. Every TLS certificate issued by a public CA is recorded in open logs (Certificate Transparency). Querying them —on crt.sh, say— lists subdomains without touching the target: dev., staging., vpn., jenkins., internal-mail.… The admin panel you thought was hidden has been in a public log for months.

3. WHOIS, Wayback and Shodan

• WHOIS: registrar, creation/expiry dates and —if you didn't enable privacy— contact details.
• Wayback Machine (archive.org): old versions of your site. Paths, forms and files you deleted may still be there, cached.
• Shodan / InternetDB: since Shodan already scanned the Internet, querying the IP is passive — it returns open ports, services and known CVEs without you scanning anything.

The defensive side: shrink the surface

Your passive footprint is what the attacker gets for free. Shrinking it is one of the best-return investments:

• Inventory your subdomains (starting with CT logs): turn off the forgotten dev/staging/demo ones. A dead subdomain pointing at an abandoned service is a subdomain takeover waiting to happen.
• Keep internal names out of public certs: for internal stuff, use a wildcard (*.corp.example.com) or an internal CA, not a per-host cert that ends up in a worldwide log.
• Review your SPF: every include: tells part of your stack. Drop the ones you no longer use (hygiene, plus you avoid the 10-lookup limit).
• WHOIS privacy and generic contact data, not personal.
• Monitor CT logs: beyond inventory, they warn you if someone issues a certificate for a domain that looks like yours — an early phishing signal.

Footprint checklist

• ✅ Enumerate subdomains via Certificate Transparency (crt.sh)
• ✅ Review MX, NS and every SPF include:
• ✅ Search your site on Wayback: any paths or files that shouldn't be there anymore?
• ✅ Check your IP on Shodan/InternetDB: any ports you didn't expect?
• ✅ Turn off dead subdomains; enable WHOIS privacy; watch CT for evil twins

Passive recon can't be prevented —it's public information— but you can control what's out there. Look at yourself through an attacker's eyes once a quarter and you'll take half their work away.

Sergio Belmonte Morales
Cybersecurity Analyst · SOC · Sentinel/KQL specialist