peerglass_passive_dns
Query historical DNS records to trace infrastructure changes, find previously-used domains, and investigate malware C2 infrastructure over time using RIPE Stat Passive DNS data.
Instructions
Query RIPE Stat Passive DNS for historical DNS records associated with an IP address or domain name. Shows what hostnames pointed to an IP (or what IPs a hostname resolved to) over time, with first/last seen timestamps and observation counts.
Useful for:
Tracing infrastructure changes over time
Finding previously-used domains for an IP
Investigating historical malware C2 infrastructure
Attribution and threat hunting
Data source: RIPE NCC's Passive DNS system, which aggregates DNS queries from recursive resolvers across the network.
Args: params (PassiveDNSInput): - resource (str): IP address or domain name - limit (int): Max records (default 100, max 500) - response_format (str): 'markdown' (default) or 'json'
Returns: str: Historical DNS records table with rrtype, value, and first/last seen dates.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |