passive recon first, active recon only when ready

two ways to look at a target, and why it matters if that target is you

recon is just information gathering. before anyone touches your systems, they're usually just looking at what's already public. understanding the difference between passive and active recon isn't just an offense concept, it's the exact roadmap you should use to audit your own exposure before someone else does.

passive recon: nobody knows you're looking

passive recon means pulling information that already exists somewhere else. whois records, dns entries, cached pages, employee emails scraped from public sources with tools like theharvester. none of this touches the target's actual servers. no logs get written on their end because nothing was sent to them directly, you're just reading data that's already sitting in public databases and search engines.

this is the scary part for defenders: passive recon can build a surprisingly complete picture of your organization without you ever seeing a single connection attempt. domain registration info, subdomains you forgot existed, employee names and email formats, technology hints from job postings or dns records. all of it just sitting there.

whois yourdomain.com
theharvester -d yourdomain.com -b all

run these against your own domain. whois shows you what registration info is publicly exposed, sometimes including names and addresses if privacy protection isn't enabled. theharvester pulls email addresses, subdomains, and hostnames tied to your domain from search engines and public sources. if you're surprised by what shows up, that's the point of the exercise.

active recon: now you're making noise

active recon is different. tools like nmap actually send packets to the target's infrastructure to see what ports are open, what services are running, what versions are exposed. this generates traffic that hits your firewall, your ids, your logs. it's the digital equivalent of walking up and knocking on every door and window to see which ones are unlocked.

the tradeoff is real: active recon gives way more actionable detail, but it's visible if anyone's watching. that's exactly why defenders need to be watching.

why the split matters for defense

most attackers start passive because it's free and invisible. they only go active once they've decided you're worth the risk of being seen. that means your passive footprint is the thing determining whether you even get a second look. a bloated public footprint, exposed employee emails, stale subdomains pointing to decommissioned servers, whois info with real names and phone numbers, all of that makes you a more attractive and easier target before a single packet is ever sent.

reducing your passive footprint doesn't stop a determined attacker, but it raises the cost and reduces the easy wins. fewer breadcrumbs means less to work with.

shrinking your passive footprint

enable whois privacy protection through your registrar so your personal or organizational contact info isn't sitting in plaintext for anyone to query. audit your dns zone and kill subdomains you're not actively using, especially ones pointing to old infrastructure that might not even be patched anymore. search your own domain in tools like theharvester periodically and see what comes back, treat it like a leaked password check. if employee emails follow a predictable pattern (first.last@company.com), assume that pattern is already known and plan your authentication accordingly, meaning strong mfa everywhere, not just password strength.

catching active recon against you

this is where your logging actually earns its keep. nmap scans, even quiet ones, leave patterns: connection attempts across a range of ports in a short window, often from a single source ip. an ids or a properly configured firewall can flag this as scan activity. tools like fail2ban can auto-block ips that trip these patterns. if you're running anything internet-facing, check your firewall and ids logs regularly for scan signatures, don't wait for an incident to go looking.

the takeaway

recon works in stages because attackers are lazy by design, they'll always take the free invisible info before risking detection. your job as a defender is to starve the passive stage by shrinking what's publicly exposed, and to actually watch your logs so the active stage doesn't go unnoticed. the less someone can learn about you without knocking, the more likely they are to knock loud enough for you to hear it.