Passive Reconnaissance

• Most of your picture is free and lawful: DNS, TLS certificates in public logs, and web indexes are already public.
• Passive work keeps you invisible and keeps the RoE intact — no traffic, no noise, no scope questions.
• A rich passive map makes the active phase faster and safer: you scan what matters, not everything.

You learn the street layout, who lives where, and the empty lots — all from the public ledger, no doorbell.

• Passive DNS tools collect historical/resolution data from public sources (e.g. certificate transparency logs).
• Search engines and their cached indexes reveal landing pages, subdomains, and accidental exposures.
• Certificate transparency logs list every TLS cert issued for a domain — an instant subdomain map.
• Public code hosts and paste sites can surface leaked files; treat everything as leads, not proof.

• A tester running an engagement of their OWN domain finds three forgotten subdomains in CT logs — the classic shadow IT.
• A SOC uses passive DNS to spot new campaign infrastructure before friends-of-friends get hit.
• A product team checks their own exposure via OSINT quarterly to see what attackers see.

• Strictly passive first: no scanning, no lookups that touch the target active hosts.
• Log your sources and timestamps; the recon trail is evidence of RoE compliance.
• Treat OSINT as a map of 'what is public', never as permission to use it.
• Focus on your own assets or assets with written authorization.

• Sliding from 'passive' into active scanning the moment it gets interesting — scope rules still apply.
• Trusting a single OSINT source; digital-twin views need 2-3 confirmation sources.
• Copying leaked credentials found in public data — using them is a crime even if found 'for research'.
• Forgetting passive recon works only when the target's records are actually in the public sources.

• When CT 'finds nothing', confirm you're querying the right root and check case/IDN encoding.
• Cross-check DNS resolution between public resolvers and your own; split-horizon targets differ.
• Record timestamps in UTC; passive evidence ages and MDs get new certs.

• Passive is lawful but not gossip: never publish or reuse another org's exposure data without need.
• OSINT leads may point at real data; if you find actual leaks of others, stop and report — do not sample.