Teams should look for shared IP space, repeated ASN use, common certificate reuse, frequent domain rotation, and chained redirects that point to the same landing pages or credential harvesting flows. Redirect behaviour often reveals where scam infrastructure is concentrated, how long it survives, and whether multiple domains are being used as disposable entry points.
What scam hosting clusters usually have in common
Scam hosting clusters are rarely random. They tend to reuse infrastructure in ways that make it easier to scale, rotate, and replace abuse sites quickly. Shared IP space, repeated ASN use, certificate reuse, and recurring redirect paths are practical signals that multiple domains may belong to the same operator or service model rather than being isolated one-off sites.
A useful way to read these signals is as infrastructure correlation, not proof by itself. One shared attribute can be incidental, but several together often show that the same hosting pattern is supporting repeated landing pages, forms, or credential harvesting flows. That is what makes cluster analysis valuable for detection, takedown prioritisation, and sinkhole-style investigation.
How redirect chains expose disposable scam infrastructure
Redirect behaviour is often the clearest clue. Scam domains frequently bounce through chained redirects, registrar churn, or short-lived intermediaries before reaching the same final page. When many domains resolve into the same destination flow, teams can identify a cluster even if the entry points keep changing.
The practical value is that redirects show both concentration and churn. Concentration tells you which landing pages or collection endpoints matter most, while churn shows how quickly operators replace burned domains. Teams should pay attention to whether redirects are technically simple, whether they are gated by user agent or referrer checks, and whether they converge on a small number of credential capture pages.
How to use cluster signals in triage and response
Cluster indicators become most useful when they are combined rather than treated in isolation. Shared IP space, repeated ASN patterns, certificate reuse, and redirect convergence can be fed into block lists, threat hunting, and takedown requests. The point is to separate the durable infrastructure from the disposable domains that sit in front of it.
For defenders, the strongest operational question is whether a cluster is only hosting scams or also supporting credential theft and downstream account takeover. If the same hosting pattern repeatedly leads to login lookalikes, teams should treat the cluster as an abuse infrastructure set, not as a collection of unrelated spam pages. That framing helps prioritise containment, reporting, and monitoring.
Risk and Threat Considerations
Scam hosting clusters matter because they reduce the cost of repetition for attackers. When one domain is blocked, the operator can swap in another domain, reuse the same hosting footprint, and preserve the same landing page or harvesting flow. That creates persistence through infrastructure churn and makes simple domain-by-domain blocking less effective.
Failure mechanism: Defenders focus on single domains, while the operator keeps the same IP, certificate, ASN, or redirect path and swaps the visible entry point. The cluster survives because the underlying abuse infrastructure is more stable than the surface domain.
Impact: The same scam campaign can continue despite takedowns, victims can be funnelled to the same credential harvesting flow through new domains, and response teams may underestimate the true scale of the abuse if they do not group related indicators together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Scam clusters rely on reused hosting infrastructure and rotation. |
| T1589 — Gather Victim Identity Information | Credential-harvesting flows are central to scam landing pages. | |
| Recommendation — Map shared hosting and domain reuse to infrastructure acquisition and hunt for the supporting footprint. Track scam pages that funnel victims into credential collection and monitor for downstream abuse. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Cluster detection depends on correlating IP, ASN, certificate, and redirect signals. |
| Recommendation — Correlate network and DNS telemetry to group related scam infrastructure quickly. | ||
Practitioner Guidance
What to verify: Check whether the domains share more than one infrastructure trait, not just one. The strongest cases usually combine IP overlap, ASN repetition, certificate patterns, and redirect convergence into the same final landing page.
Decision rule: If the same redirect destination or harvesting flow appears across multiple short-lived domains, treat it as one campaign cluster and investigate the shared infrastructure first. If only one indicator is present, keep the finding as a lead rather than escalating it as a confirmed cluster.
Practitioner takeaway: The goal is to identify the stable abuse layer behind the disposable domains, because that is usually where the most useful detection, takedown, and blocking decisions can be made.
Related resources from NHI Mgmt Group
- What are the signs that a crypto scam investigation is focused on the right transaction clusters?
- What does good NHI governance look like for audit and compliance purposes?
- When does sovereign cloud become an IAM problem instead of a hosting problem?
- Why are AI-generated passwords risky even when they look complex?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org