Recipe Difficulty: Medium
Python Version: 3.5
Operating System: Any
This recipe explores the PassiveTotal API and how to use it to automate the review of domains and IP addresses. This service is particularly useful in viewing historical resolution details for a given domain. For example, you may have a suspected phishing website and, based on historical resolution patterns, can identify how long it has been active and what other domains used to share that IP. This then gives you additional domains to review and search for, in your evidence as you identify the different means and methods of how the attackers maintained persistence as they compromised multiple users across the environment.
