Infrastructure Outlives the Payload

Adversary Tracking · June 28, 2026 · 10 min read

The cheapest thing an adversary can change is the thing most defensive programmes track hardest.

A file hash is altered by recompiling, by padding a section, by any of a dozen automated transformations that cost seconds. A hostname is a registration. A detection built on either has a lifetime measured in the adversary’s convenience. The well-known ranking of observables by how much they cost to replace — the pyramid of pain — captured this years ago, and its central insight is still routinely ignored in practice: the value of an indicator is inversely proportional to how easily the adversary can discard it.

What sits higher in that ranking, and is far less commonly worked, is the infrastructure an operation must actually keep standing.

Why infrastructure is expensive to churn

Adversaries reuse infrastructure for the same reasons everyone reuses infrastructure: setting it up takes time, working configurations are hard to reproduce, and the people doing it are operators with throughput targets rather than artists.

Standing up a redirector chain that survives takedowns, obtaining hosting that tolerates the traffic, configuring a control panel, provisioning certificates, registering domains that clear reputation checks, and doing all of it without reusing anything traceable is a real workload. Doing it fresh for every target multiplies that workload by the number of targets. So it does not happen. It gets scripted, templated, purchased in bulk from the same supplier, and inherited from the last operation.

Every one of those economies leaves a mark, and the marks persist precisely because removing them would cost the operator something.

What actually persists

The durable traces are rarely the flashy ones.

Provisioning habits. Which registrar, which hosting provider, which autonomous systems, which country’s virtual private servers. Which certificate issuer, and whether certificates are issued individually or in batches. These reflect supplier relationships and payment methods, both of which are annoying to change.

Configuration fingerprints. The set of ports a host exposes, the order in which a service negotiates, the default banner nobody edited, the framework version behind the panel, the favicon that shipped with the template, the exact directory layout of a staging path. Tooling installed from the same script produces the same fingerprint on every host it touches.

Certificate and naming patterns. Self-signed certificates carrying a distinctive subject field. Domains built from a consistent word-pair scheme. Subdomain conventions that mirror an internal naming standard. Human naming habits are stubborn, and automation makes them uniform.

Timing. Registration clustered into a short window before an operation. Certificates issued in a batch. Hosts brought online in a predictable sequence relative to first use. Timing is the observable operators think about least.

Individually, none of these identifies anything. Combined, they define a set — and a set that can be enumerated is a set that can be watched.

The pivot, and how it goes wrong

The method is pivoting: start from one confirmed observable, find an attribute of it, enumerate everything else sharing that attribute, evaluate what comes back, and repeat.

The technique is simple and the discipline is not, because the failure mode is silent. Every pivot key has a selectivity — how many unrelated things share it — and using a low-selectivity key silently converts a tight cluster into a large pile of unrelated hosts.

The classic examples are all mundane. Pivoting on shared hosting where thousands of tenants sit behind one address. Pivoting on a content delivery network address that fronts half the internet. Pivoting on a default certificate that ships with a widely deployed appliance and therefore appears on every installation of it. Pivoting on a privacy-protected registration whose contact details are the privacy service’s, shared with every other customer.

Two rules keep it honest. Estimate the selectivity of a pivot key before trusting its results — if the attribute appears on a hundred thousand hosts, it is not a link, it is a category. And require independent corroboration: two weakly selective attributes co-occurring is meaningful in a way that either one alone is not, provided the two are genuinely independent and not both consequences of the same underlying platform choice.

Time is not an afterthought

An address is a lease. A domain is a registration with a term. A certificate has a validity window. None of them is a permanent property of anything, and a tracking claim that omits time is not a claim at all.

“This address is adversary infrastructure” is unfalsifiable and will eventually be wrong. “This address served this control panel between these two dates, observed by this means” is a statement that can be checked, aged out, and correctly excluded when the provider recycles the lease to a legitimate tenant.

Any store of tracked infrastructure needs first-seen and last-seen on every element, an explicit confidence, and a note of what the observation actually was. Without those, the store degrades into a list of addresses that progressively poisons every downstream use — the block list that takes out a customer, the hunt that returns nothing but noise, the report that asserts a link long after it dissolved.

What defenders get from it

Three things, in descending order of how often they are realised.

Retrospective visibility. Once a set of infrastructure is characterised, you can look backwards through your own telemetry for contact with any of it. This is where tracking most often pays, because it converts an external observation into an internal answer about your own history.

Pre-positioning. Infrastructure is frequently stood up before it is used. A domain registered, a certificate issued, a panel deployed — and then a quiet gap before the first phishing message. That gap is the only period in an operation where a defender can act before anything has happened to them, and it exists only for people who are watching provisioning rather than payloads.

Behavioural detection. Enumerating the machinery of an operation teaches you how it is built, and the construction pattern generalises further than any individual host. A detection for the shape of a redirector chain outlives every address in it.

The limits worth stating plainly

Infrastructure tracking is slow, skilled, and easy to do badly. It rewards patience and punishes automation applied without judgement, because the automation happily follows a low-selectivity pivot into a swamp and reports confidence.

It also has a scope boundary that should not be crossed. This is observation of what is publicly visible — resolution data, certificate transparency, scan results, registration records. It is not access to somebody else’s systems. The line is not subtle, and the fact that a host is being used against you does not move it.

And for many organisations the honest assessment is that this is not their work. A team without reliable internal telemetry gains far more from fixing that than from cataloguing hosts elsewhere. Tracking infrastructure is a capability that pays once you can act on what it produces; before that, it is a hobby with a budget line.