## Infrastructure OSINT

Adversaries need infrastructure to attack you. They need Domains for Phishing and IPs for Command & Control (C2). By analyzing this infrastructure, we can pivot and find more of their network.

---

### 1. WHOIS Data
WHOIS is the registration record for a domain. It tells you:
*   **Registrar**: GoDaddy, Namecheap, etc.
*   **Dates**: Creation Date (New domains are suspicious!), Expiry Date.
*   **Registrant**: Name, Email, Phone.
*   **Name Servers**: `ns1.hosting.com`.

> ⚠️ **The GDPR Problem**: Since 2018 (GDPR), most personal WHOIS data is "Redacted for Privacy". However, historical WHOIS services (like Whoxy or various paid tools) often cached the record *before* it was redacted.

### 2. DNS Enumeration
DNS is the phonebook of the internet. We want to find every subdomain associated with a target.
*   **A Record**: Maps `domain.com` -> `1.2.3.4` (IPv4).
*   **CNAME Record**: Alias. `blog.target.com` -> `wordpress.com`.
*   **MX Record**: Mail Exchange. Tells you who hosts their email (e.g., `protection.outlook.com` means they use Microsoft 365).
*   **TXT Record**: Often reveals trust relationships. `include:sending.service.com` in SPF records tells you they use that vendor for marketing emails.

### 3. Certificate Transparency (CT)
This is a goldmine for OSINT.
When a Certificate Authority (like Let's Encrypt) issues an SSL/TLS certificate, they MUST publish it to a public **Certificate Transparency Log**.
*   **Why it helps**: If an attacker sets up `phishing.target-login.com` and gets an SSL cert to make it "secure", that hostname appears in the public CT logs **immediately**.
*   **Tool**: `crt.sh`. Just search `%target.com` to see every sub-domain they have ever secured.

### Pivot Techniques
*   **Reverse DNS**: "What other domains are hosted on this IP?" (Shared hosting vs Dedicated C2).
*   **Reverse Analytics**: "What other websites share this Google Analytics ID?" (Links attacker sites together).
*   **Reverse WHOIS**: "Show me all domains registered by `badguy@evil.com`."