Chapter 16 — Threat intelligence and OSINT: methods II
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Pivoting"]
N2["16.2 Shared services"]
N3["16.3 Certificate transparency"]
N4["16.4 Confidence"]
N5["16.5 Recording pivots"]
N6["16.6 Stopping rules"]
N7["16.7 Registration data"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Pivoting"]
N2["16.2 Shared services"]
N3["16.3 Certificate transparency"]
N4["16.4 Confidence"]
N5["16.5 Recording pivots"]
N6["16.6 Stopping rules"]
N7["16.7 Registration data"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Pivoting]
|
v
[16.2 Shared services]
|
v
[16.3 Certificate transparency]
|
v
[16.4 Confidence]
|
v
[16.5 Recording pivots]
|
v
[16.6 Stopping rules]
|
v
[16.7 Registration data]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) pivot carefully from one indicator to related infrastructure using passive sources; (2) avoid pivoting through shared services; (3) monitor certificate transparency for lookalikes; (4) write findings with confidence levels.
16.1 Pivoting
From a fraud domain, an analyst may look at passive DNS (what addresses it used), certificate records (which other names shared the certificate), and registration timing. Each pivot can reveal related infrastructure — or mislead.
In the worked example below, the certificate pivot from corvale-permits-pay.example found a second name, corvale-tax-pay.example, and the address pivot was stopped. Each pivot uses passive data from approved services, so CMS never connects to the fraud infrastructure. The risk is in the reading: a shared address or registrar can make unrelated sites look connected.
16.2 Shared services
Cloud hosting, content-delivery networks and privacy-protected registrations are shared by thousands of unrelated customers. Pivoting through them links innocent sites. Lena stops a pivot when the shared item serves many unrelated names.
The address in the worked example below was a large cloud provider address shared by thousands of sites, so following it would have listed thousands of unrelated names as suspects. Blocking any of those names would harm owners who had done nothing wrong. Lena stops at such points and records why, so a reviewer can see the pivot was deliberately ended rather than missed.
16.3 Certificate transparency
Publicly trusted certificates appear in public logs. Searching for names containing "corvale" with payment words finds lookalikes early. This is passive and lawful through approved search services.
A certificate is often requested before a fraud page goes live, so a new certificate for a name such as corvale-tax-pay.example can warn CMS before residents receive any text. Searching through approved services keeps the method passive: Lena reads public logs and never contacts the site the certificate was issued for. Lena saves each search with its date, because certificate logs keep growing and a later search returns more results.
16.4 Confidence
Write "likely related" only when two independent pivots agree, such as shared certificate and registration minutes apart. One weak link is "possibly related".
In the worked example, the two domains share a certificate issued at the same minute, which is a strong link, and Lena still reports moderate confidence. The address they share counts for nothing, because thousands of sites use it. Writing likely or possibly makes the reader aware of how much weight the link can bear. The confidence wording is copied into the change request, so the network team sees how strong the link is before blocking.
16.5 Recording pivots
Each pivot step is logged: source, query, result and decision. Others can repeat or challenge it.
A logged pivot looks like this: certificate search for corvale-permits-pay.example, result a certificate also covering corvale-tax-pay.example, decision follow it. Another analyst can run the same query and either confirm the result or find that the data changed. Without the log, the conclusion would rest only on Lena's memory of each step. Pivots that were stopped are logged as well, with the reason, such as the shared cloud address in the worked example. A reviewer can then see both the paths followed and the paths deliberately left, and judge whether the stopping decisions were sound.
16.6 Stopping rules
Set a limit — three pivots or 30 minutes — unless the supervisor extends it. Endless pivoting wastes time and drifts from CMS's question.
The limit protects CMS's question, which is usually what to block and what to report for takedown. After three pivots, new findings tend to be further from Corvale and closer to general infrastructure. If the supervisor extends the limit, the reason is written in the pivot log, so time spent beyond it is a decision rather than drift. The limit also protects Lena's time for triage, which would otherwise wait while one domain absorbed the morning.
16.7 Registration data
Public registration records are often redacted for privacy. Analysts do not try to uncover redacted registrant identities; the domain and its timing are enough for defence.
Uncovering a redacted registrant would mean collecting personal data CMS does not need, and possibly using methods outside the approved list. For defence, the facts that matter are the domain, when it was registered and what it resembles. Those are enough to request a block and a takedown. The redaction is respected even when the domain is clearly fraudulent, because the limit concerns CMS's methods rather than the target's character.
Takedown requests
Takedowns go through CMS's supervisor or a contracted service, citing the impersonation and evidence. Lena prepares the evidence package — screenshots from approved services, certificate records, resident reports — but does not contact hosting providers herself.
Worked example
From corvale-permits-pay.example, Lena finds the certificate also covers corvale-tax-pay.example, issued the same minute. Passive DNS shows both on a large cloud provider address shared by thousands of sites, so she does not pivot further through the address. She reports both domains as "likely related, moderate confidence" for blocking and takedown requests.
Synthetic case. The domains are invented.
Errors and limits
Passive datasets are incomplete and sometimes outdated.
Exercises
- EX046 — Stop the pivot. When should Lena stop pivoting through an address? Rubric: 3 = shared by many unrelated sites (cloud/CDN); 2 = partial; 1 = never; 0 = none.
- EX047 — Likely wording. What evidence justified "likely related" for the two domains? Rubric: 3 = same certificate, issued same minute (two links); 2 = one; 1 = address; 0 = none.
- EX048 — Redacted registrants. Should Lena try to uncover redacted registrant identities? Rubric: 3 = no; privacy; unnecessary for defence; 2 = no; 1 = yes; 0 = none.
Synthesis
Pivot passively and briefly, stop at shared services, use certificate transparency and calibrate confidence to independent links.
Continue studying — chapter 16 of 30
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →