recon-a-domain-passively

# Recon a domain passively Turn one domain into a defensible map of an organization's internet-facing estate plus the owner behind it. The techniques live in other skills; what this workflow contributes is the **order**, the **inventory**, and the **stopping rule**. Two failure modes to avoid from the start: enumerating for hours and producing 400 hostnames with no attribution, dates or priority, which is not a map; and drifting active without noticing, because one probe "just to check if it's up" ends the passive claim. Decide the passive boundary before step 2, not during it. ## Ordering logic Each stage feeds the next, and the sequence is cheapest-and-quietest first: | Order | Stage | Why here | |---|---|---| | 1 | Registration and DNS | Defines the perimeter. Without the apex set and the registrant you do not know what is in scope | | 2 | Name expansion | Archival sources only. Costs nothing, touches nothing, produces the candidate list everything else consumes | | 3 | Resolution and inventory | Converts names to addresses, which is what infrastructure lookups take as input | | 4 | Infrastructure and services | Needs stage 3's addresses. Third-party scan data only | | 5 | Content, history, code, tech stack | Needs hostnames and org names from earlier stages as search terms, and reuses artifacts already collected | | 6 | Owner attribution | The registrant, tenant and organization names surfaced above are the input | Run stages 1–5 as a loop, not a line. Every stage pr...