Lion Cipher Lab

Pivot on passive DNS to map adversary infrastructure (and prune the shared-hosting trap)

• Threat Intel Analyst
• Intermediate
• ~45 min
• Free · no account required

Why it matters

You get handed one indicator -- a single malicious domain from an alert or a report -- and the obvious move is to look up the IP it points to right now. That tells you almost nothing, because a live DNS lookup is a single snapshot: one domain, one current IP. The adversary rotates IPs, fronts behind a CDN, and spins up a dozen sibling domains you never saw because they were never in your alert. PASSIVE DNS (pDNS) is how investigators get the history a live lookup throws away: a pDNS sensor passively records which name resolved to which IP, with the first time and last time it saw each pairing…

What you'll learn

• defining passive DNS (pDNS) -- a historical record of observed DNS resolutions, each a (domain, ip, first_seen, last_seen, count) observation collected by a sensor -- and why it answers questions a live lookup cannot
• building a small pDNS store from a seeded CSV with only the Python standard library (csv, collections, datetime -- no pip, no network, no API key)
• implementing the two core pivots: IP -> domains (co-hosting / shared infrastructure) and domain -> IPs over time (infrastructure rotation), plus reading first-seen / last-seen windows
• walking from ONE known-bad indicator out to the full historical cluster with a breadth-first pivot, and measuring how much bigger that cluster is than the single live lookup (1 domain / 1 IP -> 26 domains / 3 IPs)
• recognising and PRUNING the shared-hosting / CDN trap: one benign IP that co-hosts 23 unrelated domains over-links the cluster, and removing it shrinks 26 domains / 3 IPs back to the true adversary set of 5 domains / 2 IPs
• distinguishing pDNS pivoting from live dig/whois recon (point-in-time), from fast-flux detection (rotation on one domain), and from ASN/prefix clustering (grouping by network owner)
• carrying the core judgment that an IP is a weak indicator (Pyramid of Pain): shared hosting, CDNs, parked-domain IPs and cloud load balancers create false links, pDNS visibility is partial and seen-dates are sensor-relative, so every pivot must be corroborated before it becomes attribution

Steps in this lab

1. What passive DNS is -- every term, defined once
2. When you'd reach for this -- and what it is NOT (dig, fast-flux, ASN)
3. Build the passive-DNS store from seeded data
4. Write the pivot tool -- two indexes, two pivots
5. Measure the BEFORE: naive lookup vs the full pivot
6. The correction: prune the shared-hosting trap
7. Honest negatives -- where a pivot lies, and what to do about it
8. What you built -- and the reflex to keep

Open the full interactive lab →