Passive DNS.
Passive DNS databases/services are provided my a number of companies like VirusTotal (Google) and Palo Alto Networks. PDNS is often used in malware analysis.
When you do nslookup just check what DNS resolver you are querying. With multiple trials with different names you may be able to differentiate which one is leaking the domain information.
4 Likes
Like:
nslookup using-1s-for-this-test.example.com 1.1.1.1
nslookup using-8s-for-this-test.example.com 8.8.8.8
nslookup using-9s-for-this-test.example.com 9.9.9.9
[you can get creative!]
6 Likes
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.