Spider Mal: Deep PassiveDNS Analysis with Maltego
Summary: Unit 42 released SpiderMal, a Python script that uses the PassiveTotal API to connect domain and IP address nodes from passive DNS data and recursively crawls from a seeded entity to a specified level to build Maltego graphs. SpiderMal adds temporal filtering so only domains or IPs seen within a specified date range appear in the graph, reducing noise compared with chaining existing PassiveTotal Maltego transforms.
Bottom line: Threat actors commonly take over legitimate systems to run campaigns, so unfiltered recursive lookups can bury an analyst in data that has no bearing on the threat; the date-range filter is the control that keeps the graph usable.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026