At a glance
- Starting point
- A suspicious domain or host with at least one confirmed link
- Goal
- Map the related estate, understand its purpose, and track it over time
- Core idea
- Adversaries reuse habits; infrastructure is where those habits show
- Golden rule
- Investigate passively; do not touch live attacker infrastructure
- Model
- The Diamond Model: adversary, capability, infrastructure, victim
- Sources
- WHOIS, passive DNS, internet-wide scans, certificate transparency, hosting metadata
Infrastructure is an estate, not a node
Adversaries rarely run a campaign from one box. They separate roles, a domain for the phishing lure, a redirector to launder traffic, a staging host to serve the payload, a command-and-control server to run the operation, precisely so that losing one does not lose the campaign. The Diamond Model of intrusion analysis names infrastructure as one of its four vertices for this reason: it is a distinct thing to study, connected to the adversary on one side and the victim on the other. Your job is to turn one known node into the estate it belongs to, and then read what that estate is for.
This guide picks up where How to pivot from a single IP leaves off. Pivoting finds the related nodes; investigating infrastructure is the discipline of making sense of them as a whole.
The four questions to answer
Every infrastructure investigation is really the pursuit of four answers. Keep them explicit and you will not wander:
- What is it? The role of each node, phishing, redirector, staging, C2, and how they connect.
- Who set it up? Not a name, but a fingerprint: the registration, hosting, and configuration habits that recur.
- What else is theirs? The related nodes those habits reveal, the rest of the estate.
- Is it still live, and how does it move? Whether it is active now, and how it rebuilds when disrupted.
Reading registration and naming
How a domain was registered is often the richest tell. Analysts read:
- Age and timing. A domain registered days before it was used, and clustered with siblings registered the same afternoon, is a campaign fingerprint. Freshly registered domains are disproportionately malicious.
- Naming patterns. Lookalikes of a target brand, algorithmically generated strings, or a consistent theme across many domains all point to a single operator with a habit.
- Registrar and nameserver choices. A preference for particular registrars, privacy services, or nameservers recurs across an actor's estate even when everything else changes.
- Any unique registration detail. A reused email, a distinctive registrant string, or a shared nameserver is a strong link when it is genuinely uncommon, and worthless when it is generic.
Hosting choices are a tell
Where an adversary hosts says as much as how they register. A preference for a specific bulletproof provider, a particular VPS reseller, or a certain cloud region is a habit that survives across campaigns. So is the technical build of the host itself: a distinctive combination of open ports, a reused TLS certificate, a characteristic default page, or a signature service fingerprint lets you recognise a sibling even under a brand-new domain and address.
The most durable links are the ones the adversary reuses without noticing: a copied TLS key, a templated server build, a favourite host. These sit high on the Pyramid of Pain, they cost real effort to change, so a link built on one is worth far more than a shared IP or a common cloud range.
Clustering the related nodes
With links in hand, you group nodes into a cluster that plausibly belongs to one operator, and you grade the cluster by the strength of what holds it together. Be honest about that strength:
| Shared attribute | What it suggests | Confidence |
|---|---|---|
| Reused TLS key or certificate | Same operator, copied config | High |
| Unique registrant detail | Common registration hand | High if genuinely rare |
| Same-day bulk registration | One campaign, one actor | High with corroboration |
| Distinctive service build | Same deployment playbook | Moderate |
| Same nameserver / registrar | A preference, widely shared | Low alone |
| Same cloud provider | Almost nothing | None |
A cluster is a hypothesis, not a fact. Record what links each node and how strongly, so a reader can see the difference between “these three share a private key” and “these three use a popular registrar.”
Tracking a target that rebuilds
Infrastructure is not static, and a capable adversary rebuilds after you burn a node. That is why time is a dimension of the investigation, not a footnote. Certificate transparency logs, passive DNS history, and repeated scanning let you watch an estate evolve: a new domain appears with the same registration habit, a fresh host serves the old certificate, the campaign migrates to a new provider. Tracking the pattern rather than the individual node is how you keep a target that changes its clothes every week.
Look, do not touch
A firm operational rule: investigate live adversary infrastructure passively. Prefer historical and third-party data (passive DNS, scan datasets, certificate logs, reputation feeds) over interacting with the host yourself. Directly probing or browsing an attacker's server can tip them off, may be attributed back to you, and in some jurisdictions raises its own legal questions. The estate you are mapping belongs to someone who is watching their own logs; do your looking through data that already exists.
“I just clicked the phishing link to see” is how an investigation becomes visible to its target. Assume the adversary sees every direct interaction with their infrastructure, and route your curiosity through passive sources instead.
Keeping the map coherent
The hard part of infrastructure work is not any single lookup; it is holding the whole cluster in view, with each link's strength and provenance intact, as it grows and changes. That is a correlation problem. Forensia is built to keep the estate coherent: it resolves the network, registration, and certificate context for each node, keeps the evidence attached so your confidence stays auditable, and stays explicit about what it could not verify, so the map you hand on is one someone else can trust.
Key takeaway
Behind one suspicious domain is usually an estate built from an operator's habits. Investigate it by answering four questions, what it is, who built it, what else is theirs, and how it moves, and read the tells in registration, hosting, and configuration.
Grade every link by how much it cost the adversary to create, prefer the ones they reuse without thinking, and do it all passively. The output is not a single blocked node but a tracked cluster you can recognise again the next time it rebuilds.
References & further reading
- Caltagirone, Pendergast & Betz, The Diamond Model of Intrusion Analysis, the framework placing infrastructure among the four core features of an intrusion.
- David J. Bianco, The Pyramid of Pain, on grading indicators by the cost to change them.
- Certificate Transparency, the public logs used to discover and track hosts over time.
- Censys and Shodan, internet-wide scanning services for service-fingerprint and infrastructure pivoting.
- OverWatch Labs, How to pivot from a single IP address and How to connect multiple indicators.