OSINT Domain & Infrastructure Analysis 2 — Questions and Answers
Question 1: Which DNS record type maps a domain name to an IPv6 address?
- MX
- AAAA (Correct answer)
- CNAME
- SOA
Correct answer: AAAA
The AAAA record (quad-A) maps a hostname to a 128-bit IPv6 address.
Question 2: An OSINT analyst discovers that several unrelated domains share the same Google Analytics tracking ID (UA-XXXXXX). What does this most likely indicate?
- All sites use the same web hosting provider
- The sites are likely operated by the same person or organization (Correct answer)
- The sites copied the same open-source template
- Google reuses tracking IDs across accounts
Correct answer: The sites are likely operated by the same person or organization
Identical Google Analytics IDs across domains strongly suggest a common owner or operator, a classic pivot technique in domain OSINT.
Question 3: What is the primary purpose of the ARIN (American Registry for Internet Numbers) WHOIS database in an OSINT investigation?
- To look up domain registrar contact details
- To find ASN and IP address block ownership in the ARIN region (Correct answer)
- To enumerate subdomains of a target domain
- To retrieve SSL certificate transparency logs
Correct answer: To find ASN and IP address block ownership in the ARIN region
ARIN's WHOIS service provides registration data for IP address blocks and Autonomous System Numbers in North America.
Question 4: Which tool is purpose-built to perform reverse IP lookups and find all domains hosted on a given IP address?
- dig
- nslookup
- Shodan
- HackerTarget Reverse IP API (Correct answer)
Correct answer: HackerTarget Reverse IP API
HackerTarget's Reverse IP API (and similar services like ViewDNS.info) return all domains sharing an IP, a key technique for infrastructure pivoting.
Question 5: A Certificate Transparency (CT) log search reveals a wildcard certificate for *.example.com issued 30 days ago. What is the most actionable OSINT implication?
- The domain is using free Let's Encrypt SSL
- New subdomains may have been launched recently, worth enumerating (Correct answer)
- The organization has poor security hygiene
- Wildcard certs indicate the domain is a CDN node
Correct answer: New subdomains may have been launched recently, worth enumerating
A recently issued wildcard certificate signals infrastructure expansion; analysts should enumerate subdomains to discover new attack surface or services.
Question 6: Which of the following best describes passive DNS analysis?
- Sending DNS queries directly to the target's authoritative nameserver
- Reviewing historical DNS resolution data collected by third-party sensors without querying the target (Correct answer)
- Using zone transfer to dump all DNS records from a nameserver
- Performing brute-force subdomain enumeration via DNS queries
Correct answer: Reviewing historical DNS resolution data collected by third-party sensors without querying the target
Passive DNS involves querying historical resolution databases (e.g., VirusTotal, Farsight DNSDB) rather than actively querying target infrastructure.
Question 7: When analyzing a domain's MX records, an OSINT investigator finds 'mail.protection.outlook.com'. What can be inferred?
- The organization self-hosts its email on Microsoft servers
- The organization uses Microsoft 365 (Exchange Online) for email (Correct answer)
- The domain has no email configured
- The MX record points to a spam filter only
Correct answer: The organization uses Microsoft 365 (Exchange Online) for email
The MX record 'mail.protection.outlook.com' is the standard Exchange Online Protection entry, confirming Microsoft 365 email hosting.
OSINT Domain & Infrastructure Analysis 2
Which DNS record type maps a domain name to an IPv6 address?