0

I use Virus Total for Malware Research, and I saw that it has a field called: "Passive DNS Replication", but I do not exactly understand what that means.I searched in VT blog, and they said that it is like an historical view of which domains names resolved to a given IP address in a specific moment. What I am not sure is that if for example "www.domainname.com" resolved to 1.2.3.4 in the date 2019-04-20, does it means that in that specific date, that IP hosted that domain name? I mean, it could not be that mentioned IP resolved to that domain name in a date before "2019-04-20". I am referring to Virus Total info, if someone can explain me if Im wrong I would appreciate it.

1

... does it means that in that specific date, that IP hosted that domain name?

It just means that a DNS lookup for the domain returned the given address.

It does not mean that there was some HTTP server at this host which was configured to respond to this domain name or that other services at the IP address where aware that they were reached through this domain name.

... it could not be that mentioned IP resolved to that domain name in a date before "2019-04-20"

First, this is not about an IP address resolving to a domain name but a domain name resolving to an IP address. There can actually be multiple domain names resolving to a single IP address but also one domain name resolving to multiple IP addresses. Resolving from IP to a domain name would be DNS PTR records - but this is not what this feature is about.

Also, passive DNS replication is based on watching DNS traffic. To cite from the blog article at VirusTotal: "... technology which constructs zone replicas without cooperation from zone administrators, based on captured name server responses ...". This means that they can only replicate DNS configuration for domains which were actively queried and where the queries were seen by the DNS servers or traffic nodes they control. Thus it can still be that the domain had this IP address before, only that no access to the domain was seen before and thus no previous configuration could be determined.

  • and regarding to the part "it could not be that mentioned IP resolved to that domain name in a date before "2019-04-20" ", that is true or false(?) – victor26567 Apr 26 at 21:36
  • @victor26567: see updated answer. – Steffen Ullrich Apr 27 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.