# WHOIS, Passive DNS, Certificate Transparency, and Infrastructure Pivoting

> Use registration data, passive DNS and Certificate Transparency to pivot from one indicator to an operation, rating every link.

Canonical: https://codelivly.com/rooms/cti-whois-pdns-ct-pivoting
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 6 |
| XP | 100 |

**Purpose.** This module turns single indicators into infrastructure maps. You will learn what registration data still offers after GDPR redaction, how to use passive DNS and Certificate Transparency as historical sources, and how to pivot systematically while rating the strength of every link.

**Prerequisites.** Modules 1 to 3 of this learning path, in particular DNS record types, hosting context and X.509 certificate fields.

**Learning outcomes.** After this module you can:

- Interpret RDAP and WHOIS responses, EPP status codes and redacted records, and identify which fields still support analysis.
- Reconstruct a domain's hosting timeline from passive DNS and find neighbours with overlapping time windows.
- Search and deduplicate Certificate Transparency data and follow shared SANs and public key reuse.
- Rate pivots as strong, moderate, weak or very weak, apply stopping conditions, and document a pivot graph with confidence levels.

**Practical completion objective.** Complete two labs: pivot through a synthetic passive DNS export to identify sibling phishing domains while excluding previous tenants and CDN noise, and analyse synthetic Certificate Transparency results to produce a justified takedown candidate list.

## Lessons

1. WHOIS, RDAP and Registration Data After GDPR (15 min)
2. Passive DNS: Historical Resolution Data (15 min)
3. Certificate Transparency Logs (15 min)
4. Pivoting Methodology and Pivot Quality (15 min)
5. Lab: Pivot Through Passive DNS Records (50 min)
6. Lab: Find Related Infrastructure in Certificate Transparency Data (45 min)

## Related

- [Learning path: OSINT and Indicator Analysis](https://codelivly.com/learning-paths/cti-osint-indicator-analysis)
- [All rooms](https://codelivly.com/rooms)