Start infrastructure hunting by building a baseline of the domains, IPs, certificates, hosting patterns and naming conventions used by your organisation and its known threat actors. Then look for deviations, shared artefacts and newly registered infrastructure that matches those patterns. Prioritise alerts that overlap with active phishing, malware delivery or credential theft campaigns.
Build the first hunting baseline
The best place to start is not with tooling, but with a known-good picture of what “normal” looks like for your organisation. infrastructure hunting depends on a baseline of your domains, IP space, certificate patterns, hosting providers, DNS naming conventions and recurring infrastructure habits so that you can spot assets that do not fit the expected footprint.
That baseline should include both stable corporate infrastructure and the kinds of infrastructure your threat landscape tends to reuse, such as short-lived registrations, lookalike naming, unusual certificate reuse and hosting patterns that mirror known campaign infrastructure. The value is in comparison: hunting is mostly pattern recognition against what you already understand about your own exposure.
For a structured starting point, NHIMG’s Threat Intelligence Guide helps you connect infrastructure patterns to intelligence requirements, while the Threat Hunting Guide shows how to turn that baseline into repeatable hypotheses and hunts.
What to look for in early hunts
Once the baseline exists, begin with deviations that are easy to test and likely to matter operationally. Newly registered domains, unusual certificate issuance, mismatched hosting geography, domain name structures that resemble prior attacker clusters and reused infrastructure traits are all useful early signals because they can be compared against what your organisation already uses and what known adversaries tend to reuse.
The most productive early hunts are usually the ones that join several weak signals together. A domain alone may be ordinary, but a domain plus a newly issued certificate, plus an unfamiliar registrar pattern, plus a naming convention that resembles past phishing infrastructure is far more actionable. That is especially true when the infrastructure appears in the same window as active phishing, malware delivery or credential theft activity.
Do not treat every deviation as malicious. Infrastructure hunting is a triage exercise, not a bulk alerting exercise, and the goal is to isolate the small set of assets that are both unusual and consistent with known adversary infrastructure behaviour.
Move from discovery to validation
After a candidate is identified, validate it by asking whether it is merely unfamiliar or genuinely suspicious. Check whether the registration date, certificate history, DNS record changes, hosting transitions and naming similarities create a coherent story that fits an adversary infrastructure pattern. The strongest candidates are those that match several traits at once and sit near other suspicious activity already under investigation.
This is where infrastructure hunting becomes more than asset discovery. You are testing whether the observed infrastructure is part of an active campaign, a staging asset, a disposable relay or a reused host tied to a broader intrusion set. If the infrastructure overlaps with phishing, malware delivery or credential theft, move it up the queue quickly, because the likelihood of downstream compromise is materially higher.
Risk and Threat Considerations
Infrastructure hunting carries a visibility risk if the baseline is incomplete, because you can miss attacker assets that look ordinary until they are compared with your own patterns and external campaign traits. The other risk is overload, where too many low-value anomalies distract analysts from the infrastructure that is actually supporting an active operation.
Failure mechanism: Attackers exploit normal-looking domains, certificates and hosting patterns, then vary only enough details to blend into routine internet noise or to reuse infrastructure across campaigns without immediate detection.
Impact: Weak baselining can let phishing, malware delivery and credential theft infrastructure persist longer, increasing the chance of user compromise, credential exposure and follow-on intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Infrastructure hunting looks for attacker-registered or reused hosting and domains. |
| T1586 — Compromise Accounts | Active phishing and credential theft often support infrastructure setup and reuse. | |
| T1566 — Phishing | The answer prioritises infrastructure tied to phishing campaigns and lure delivery. | |
| Recommendation — Map suspicious domains and hosts to T1583 patterns and investigate staging activity. Correlate infrastructure sightings with account-compromise evidence in your hunt queue. Track phishing infrastructure indicators alongside domain, certificate, and hosting anomalies. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Hunting depends on log visibility across DNS, certificates, hosting and related telemetry. |
| Recommendation — Centralise and retain telemetry needed to compare infrastructure against your baseline. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Hunting relies on monitoring for unusual infrastructure patterns and campaign overlap. |
| Recommendation — Use continuous monitoring to surface infrastructure deviations and suspicious reuse. | ||
Practitioner Guidance
What to prioritise: Start with the handful of patterns that recur across your own environment, then compare them to infrastructure linked to current phishing, malware and credential theft activity. If you cannot explain why a domain or host fits your normal pattern, it is a better hunting candidate than a generic anomaly with no campaign context.
What to verify: Confirm that each hunt can answer three questions, who registered or hosted the asset, what other assets share its traits, and whether the infrastructure appeared before or during a known malicious activity window. That keeps the hunt anchored to evidence rather than intuition.
Practitioner takeaway: Infrastructure hunting works best when analysts treat “normal infrastructure” as a measurable baseline and use pattern overlap, not single indicators, to decide what deserves escalation.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org