Infrastructure is the invisible backbone of every cyber operation. Before an adversary can phish a target, deploy ransomware, or exfiltrate sensitive data, they must first establish the servers, domains, and communication channels that make their attack possible. Without infrastructure, even the most sophisticated exploit is useless , there is no way to receive stolen credentials, no command-and-control channel to manage compromised machines, and no platform from which to launch payloads. Infrastructure acquisition is not an optional step in the attack lifecycle; it is the foundational prerequisite that transforms theoretical capability into operational reality.

The barriers to acquiring malicious infrastructure have never been lower. Major cloud providers , AWS, Azure, Google Cloud, DigitalOcean, and Linode , offer free trial periods that provide attackers with powerful computing resources at zero initial cost. Domain registrars process new registrations in minutes, and WHOIS privacy services allow anonymous ownership. Cryptocurrency payments, including Bitcoin and privacy-focused Monero, make it virtually impossible to trace financial transactions back to the real purchaser. According to threat intelligence reports, over 11,800 domains registered in the first half of 2025 alone were observed in malware communications, and APT groups routinely leverage commercial VPN services like ProtonVPN, IVPN, SurfShark, and the Tor network to anonymize their operational traffic.

The use of legitimate infrastructure services creates a significant detection challenge for defenders. When adversary traffic originates from AWS IP ranges, communicates through Google Drive webhooks, or uses Cloudflare CDN for payload delivery, it becomes extremely difficult to distinguish malicious activity from normal organizational traffic. Threat actors have exploited this by using HubSpot and MailerLite marketing platforms to hide phishing senders behind reputable domains, leasing servers from resellers to avoid direct interaction with hosting companies, and purchasing infrastructure with prepaid cards and stolen cryptocurrency to maintain complete anonymity. The MITRE ATT&CK framework identifies eight distinct sub-techniques under T1583, reflecting the extraordinary diversity of infrastructure options available to modern threat actors.

SSL/TLS Fingerprinting (JA3/JA4)

Beyond the certificates themselves, the TLS negotiation process reveals unique fingerprints of the client and server software. The JA3 and newer JA4 fingerprinting methods create hashes of TLS parameters (cipher suites, extensions, elliptic curves) that can identify specific malware families and attack tools. When a new domain exhibits a JA3 fingerprint matching known adversary tooling (such as Cobalt Strike's default beacon, Metasploit, or custom Python-based C2 frameworks), it provides strong evidence of adversary infrastructure. Hunters should maintain a database of known malicious JA3/JA4 fingerprints and alert on any new domain exhibiting matching fingerprints, regardless of how legitimate the domain name or website may appear.

Passive DNS Analysis

Passive DNS replication databases record the historical IP addresses associated with every domain name observed in DNS queries. By querying these databases , through services like SecurityTrails, VirusTotal Graph, PassiveTotal, or DNSDB , hunters can identify domain names that have resolved to IP addresses previously associated with known malicious activity. Even if an adversary changes the IP address a domain resolves to, the historical DNS record reveals the connection. Key hunting patterns include: domains that have resolved to IPs on multiple different cloud providers in short succession (infrastructure rotation), domains sharing the same IP address as known malicious domains (IP co-hosting), and newly observed domains that immediately resolve to long-tail IPs with no prior DNS history (newly provisioned infrastructure).

Domain Registration Pattern Analysis

Analyze bulk domain registration data for patterns indicative of automated acquisition campaigns. Red flags include: multiple domains registered within minutes of each other using the same registrar, domains using privacy protection services from the same provider, domains with auto-generated names (random character strings or algorithmic patterns suggesting DGAs), domains registered with similar registrant email patterns (temp emails, sequential usernames), and TLD concentration in registrars known for lax abuse response. The Forescout 2025 report identified that 91% of .cc domains used in phishing were malicious, and ccTLDs like .ru, .us, and .co showed similarly elevated abuse rates. By monitoring registration velocity , the rate at which new domains are acquired by a single registrant or within a narrow time window , defenders can identify infrastructure staging campaigns before the domains are actively weaponized.

ASN & IP Reputation Analysis

Autonomous System Numbers (ASNs) provide another valuable lens for identifying adversary infrastructure. Threat actors frequently reuse the same cloud providers, hosting companies, and VPN services across multiple campaigns, creating detectable patterns at the ASN level. By maintaining a reputation database of ASN-to-threat-group associations and monitoring for new infrastructure provisioned on previously clean ASNs that suddenly begin exhibiting suspicious behavior (such as rapid DNS changes, unusual certificate requests, or outbound connections to known malicious destinations), hunters can identify infrastructure acquisition in near-real-time. The CrowdStrike WARP PANDA report demonstrated how a single threat group consistently provisioned infrastructure on the same set of ASNs, a pattern that, once identified, enabled proactive detection of new campaign staging activity months before the actual attacks were launched.