Roll for Investigation: A Beginner's Guide to Pivoting

My ADHD lives for pivoting. There is nothing like the little dopamine hit of "wait... wtf is that...?"

If you're new here, "pivoting" is taking one thing you know and using it to find related things you don't. You may start with a single suspicious domain, and you ask: what server is it on? What else is on that server? Who registered it, and what else did they register? Every answer is a new thread to pull. That's how one alert becomes a campaign. (Quick refresher on the term lives in the Glossary.)

Your Free Toolkit

You don't need a fancy platform to start. Every one of these is free or has a free tier

(And don't you dare even think about going to a malicious domain all willy nilly. We have the technology, we can sandbox it lol)

• urlscan.io: Your new bestie. It scans webpages for you, just know that if you do a public scan, that means it's public to an attacker as well.
• crt.sh: Searches Certificate Transparency logs, the public record of every TLS certificate issued. Great for finding sub- and sibling domains.
• ICANN Lookup: Official registration data (registrar, creation date, status) for a domain. This is what people mean by WHOIS or RDAP.
• VirusTotal: Also part of the IOC exercise. Check the Relations tab on a domain or IP for related files, URLs, and resolutions.
• DNSDumpster: Quick DNS recon. What a domain resolves to and what lives around it.
• Shodan and Censys: Search engines for internet-connected servers. Good for asking "what else looks like this server?"
• Pulsedive: Indicator enrichment with an intuitive and friendly interface.

More of my favorites (and my honest opinions on them) are on the Tools page.

Ground Rules Before You Touch Anything

I'm going to be your annoying older sibling for a second, because these matter:

1. It bears repeating: Don't visit suspicious sites in your own browser. That's what urlscan is for. Let a scanner take the risk.
2. Search before you scan. Someone has often already scanned the domain you care about. Searching is completely passive.
3. Know your scan visibility. Another re-hash from above: a public urlscan scan is visible to everyone, including the people running the site you're investigating. When in doubt, use unlisted or private scans (depending on your tier and availability), or just search.
4. Follow your work policies. If you're doing this on a work machine, make sure it's allowed. I love SOC engineers, I don't want one of yours to hate me for this exercise lol

Try It: Your First Pivots (Safe Edition)

Just like the EICAR exercise, we're going to practice on something completely harmless: I would say me, but my site isn't mature enough to have cool findings, so let's use a domain that gets a LOT of... fun... workday.com! Everything below is passive. You're only reading public records, never touching the site itself (but it also wouldn't matter if you did).

1. Go to crt.sh and search %.workday.com (with a % wildcard in front). Every subdomain that ever got a certificate shows up. That's what an attacker sees when they map your org, and what you'll see when you map theirs.
2. Go to urlscan.io and search page.domain:workday.com. Open one of the results.
3. Click the HTTP tab. Every line is a request the page made. Look at the domains it talked to: your own CDN, analytics, fonts, maybe an API on a different domain. Each of those is a potential pivot.
4. Find an image in that list, maybe workday-logo-primary.png, click the far right magnifying glass, and look for its resource hash. If you click it, it will search hash:{{your_hash_here}}. Which other sites load the exact same file?
5. Finally, look up your domain on ICANN Lookup. Registrar, creation date, status. Those are pivots too.

In step 4, if you picked a file, like that Workday logo, you probably got A LOT of results when you searched the hash! When you pick a file that ONLY that site uses, you get one. Don't be that analyst that goes WAIT ALL OF THESE PAGES HAVE THE SAME HASH onlly to find that the hash is for a blank page. Who would do that? Not me, that's FOR SURE. Never... lol

Pivot or Pitfall? (Interactive)

Now let's practice on something less friendly. Say you get an alert: login-help-desk.example and it looks a LOT like your company's login page. You search urlscan and find a scan of it. Here's what's inside.

For each artifact, make your call before you see the answer. Is it a strong pivot (likely leads to the same operator), a supporting clue (useful, but only alongside something stronger), or a pitfall (shared by so much of the internet that it means nothing)?

Write It Down Like an Analyst

• Record where every link came from, so you can explain it (and so you can find it again at 2am).
• Date everything. A domain that pointed at a server in March might not in June.
• Label your claims: observed (I saw it in a scan), inferred (I think it's related because...), or unknown. This is one place I do NOT recommend faking it until you make it lol
• Keep the dead domains. Expired and taken-down domains are your timeline. They tell you when it started and how it changed.

Mistakes I See (and Have Made)

1. Pivoting on shared infrastructure. That's the CDN example or thinking every domain on Hostinger is malicious
2. Stopping at the first match. One pivot finds some of the infrastructure, but you have to keep digging to see the whole picture.
3. Blocking before confirming. Servers and domains get resold and reused. Check what something actually serves before it goes on a blocklist.
4. Trusting your own network. If your company already blocks a malicious site, checking it from work may show it as "dead" when it's alive and well. Check from outside your network (SAFELY!) or with a scanner.
5. Mixing up "can" and "did." A phishing page can steal passwords. That doesn't mean anyone did get phished. Say exactly what the evidence shows.

That's it, you're officially dangerous! Go pull some threads (on things you're allowed to pull on). If you've got a favorite beginner-friendly pivot I didn't cover, send it my way! Reach out

Happy pivoting!