Lion Cipher Lab
Passive domain recon, part 2: map the infrastructure behind a domain with dig and RDAP
- Threat Intel Analyst
- Beginner
- ~40 min
- Free · no account required
Why it matters
Part 1 taught you to read what a domain claims about itself. An investigation soon needs the next layer: whose servers actually answer for the name, whether the answer you saw came from them or from a cache that may be an hour old, which other names and addresses sit behind it, and who the registry says holds it. Those are the threads an analyst pulls to connect one phishing domain to the infrastructure it shares with others, and to notice when a registry's record and a zone's own records disagree. The registration half of that work has also moved: ICANN built RDAP as the replacement for…
What you'll learn
- A, AAAA and CNAME lookups
- reading NS and SOA records
- querying an authoritative name server directly with dig @server +norecurse
- telling an authoritative answer from a resolver's cached one
- following a delegation from the root with dig +trace
- reverse DNS lookups with dig -x
- finding a TLD's RDAP service from the IANA bootstrap file
- reading RDAP registration data as JSON
Steps in this lab
- Where Part 1 stopped, and what this part maps
- Addresses and aliases: A, AAAA and CNAME
- Who is authoritative: NS, SOA, and asking the source directly
- Follow the delegation from the root with dig +trace
- Reverse lookups, TTLs, and why records can lie
- Registration data without WHOIS: read RDAP
- What the map is for